From 0040c811db19cf35b93aa1ab278532ace95c952f Mon Sep 17 00:00:00 2001
From: Alex Venetidis <alex@tryterra.co>
Date: Fri, 10 Jul 2026 15:40:16 +0100
Subject: [PATCH] ci: add npm OIDC release workflow (ported from terra-react);
 fix malformed packageManager
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The packageManager field '^yarn@1.22.15' is invalid (bad semver prefix) and
modern yarn 1.22.x hard-refuses to run against it — this is what has been
failing CI since the runner image bumped yarn. Publish runs the bob build
explicitly because npm publish uses --ignore-scripts and there is no prepare
script.
---
 .github/workflows/release_package.yml | 48 +++++++++++++++++++++++++++
 package.json                          |  2 +-
 2 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/release_package.yml

diff --git a/.github/workflows/release_package.yml b/.github/workflows/release_package.yml
new file mode 100644
index 0000000..978cbc5
--- /dev/null
+++ b/.github/workflows/release_package.yml
@@ -0,0 +1,48 @@
+name: Release package
+
+# Ported from tryterra/terra-react. Publishes react-native-terra-rt-react to
+# npm via npm "trusted publishing" (OIDC) — no stored token. Create a GitHub
+# Release to publish to `latest`, or workflow_dispatch (used by the
+# bump-terra-rt-react workflows in the native SDK repos).
+#
+# Requires a Trusted Publisher on npmjs.com: org tryterra, repo terra-rt-react,
+# workflow release_package.yml. The build runs explicitly (`yarn prepack`)
+# because publish uses --ignore-scripts and this package has no `prepare`
+# script.
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch/tag to publish (blank = this ref)'
+        required: false
+        default: ''
+      dist-tag:
+        description: 'npm dist-tag'
+        required: false
+        default: 'latest'
+
+permissions:
+  id-token: write # mint the OIDC token npm exchanges for a short-lived publish credential
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org/'
+      - name: Ensure npm supports trusted publishing (>= 11.5.1)
+        run: npm install -g npm@latest
+      - name: Install
+        run: yarn install --frozen-lockfile
+      - name: Build
+        run: yarn prepack
+      - name: Publish to npm (OIDC trusted publishing, no token)
+        run: npm publish --ignore-scripts --access public --tag ${{ github.event.inputs.dist-tag || 'latest' }}
diff --git a/package.json b/package.json
index 18d077d..8130ab1 100644
--- a/package.json
+++ b/package.json
@@ -84,7 +84,7 @@
   "engines": {
     "node": ">= 16.0.0"
   },
-  "packageManager": "^yarn@1.22.15",
+  "packageManager": "yarn@1.22.22",
   "jest": {
     "preset": "react-native",
     "modulePathIgnorePatterns": [