Remove npm token from workflow and Apply OIDC to publish packages #647
Conversation
🦋 Changeset detectedLatest commit: ffdfcdd The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
stackflow-docs | ffdfcdd | Commit Preview URL | Nov 04 2025, 08:46 AM |
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer / PR
participant GH as GitHub Actions
participant Registry as npm Registry
rect rgb(235,245,255)
note right of GH: Release job (updated)
end
Dev->>GH: Trigger release workflow (push/release)
GH->>GH: Check permissions (id-token, contents, pull-requests)
GH-->>GH: Use GITHUB_TOKEN for auth (NODE_AUTH_TOKEN removed)
GH->>Registry: Publish packages (publishConfig includes provenance:true)
alt publish success
Registry-->>GH: 200 OK
GH-->>Dev: Success
else publish failure
Registry-->>GH: Error
GH-->>Dev: Failure notification
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Pre-merge checks and finishing touches✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
commit: |
Deploying stackflow-demo with
|
| Latest commit: |
ffdfcdd
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://f16d133d.stackflow-demo.pages.dev |
| Branch Preview URL: | https://fix-apply-oidc-npm-registry.stackflow-demo.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.changeset/gold-ideas-burn.md(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
.changeset/*.md
📄 CodeRabbit inference engine (AGENTS.md)
Include a Changeset entry for any user-facing package change
Files:
.changeset/gold-ideas-burn.md
🪛 LanguageTool
.changeset/gold-ideas-burn.md
[grammar] ~1-~1: Hier könnte ein Fehler sein.
Context: --- ---
(QB_NEW_DE)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Workers Builds: stackflow-docs
- GitHub Check: Cloudflare Pages
| --- | ||
| --- |
There was a problem hiding this comment.
Changeset file is empty—requires package name and bump type.
This changeset file contains only YAML separators but is missing the required structured content. According to the coding guidelines, a Changeset entry is required for any user-facing package change.
The PR affects 16 publishable packages across the monorepo by adding "provenance": true to their publishConfig. The changeset should document these changes with the affected packages and their respective version bump types.
A proper changeset should follow this format:
---
"@stackflow/config": patch
"@stackflow/core": patch
"@stackflow/react": patch
"@stackflow/extension-link": patch
"@stackflow/plugin-history-sync": patch
"@stackflow/plugin-previous-stack": patch
"@stackflow/plugin-render-effect": patch
"@stackflow/react-ui-core": patch
"@stackflow/extension-basic-ui": patch
"@stackflow/esbuild-config": patch
---
Enable provenance attestation for npm packages via OIDC authentication. Updated publishConfig to include `"provenance": true` for cryptographic verification of build and publishing provenance. Also updated the GitHub Actions release workflow to use OIDC-based authentication instead of static npm tokens.Please populate the changeset with the appropriate package names and version bump types (patch/minor/major) based on the semantic versioning impact of these changes.
🧰 Tools
🪛 LanguageTool
[grammar] ~1-~1: Hier könnte ein Fehler sein.
Context: --- ---
(QB_NEW_DE)
🤖 Prompt for AI Agents
In .changeset/gold-ideas-burn.md around lines 1 to 2, the changeset is empty;
replace the empty frontmatter with a proper changeset listing the affected
packages (all set to patch) and add the release note body. Populate the YAML
frontmatter with the 16 package names each mapped to patch: "@stackflow/config":
patch, "@stackflow/core": patch, "@stackflow/react": patch,
"@stackflow/extension-link": patch, "@stackflow/plugin-history-sync": patch,
"@stackflow/plugin-previous-stack": patch, "@stackflow/plugin-render-effect":
patch, "@stackflow/react-ui-core": patch, "@stackflow/extension-basic-ui":
patch, "@stackflow/esbuild-config": patch, "@stackflow/esbuild-plugin-swc":
patch, "@stackflow/esbuild-plugin-swc-aot": patch,
"@stackflow/esbuild-plugin-swc-react": patch, "@stackflow/cli": patch,
"@stackflow/release-workflow": patch, "@stackflow/publish-config": patch; close
the frontmatter and add the body text describing enabling provenance attestation
via `"provenance": true` in publishConfig, and the GitHub Actions update to
OIDC-based authentication.
Summary
This pull request implements OpenID Connect (OIDC) authentication for the npm package publishing workflow and enables provenance attestation for all published packages, enhancing the security and transparency of the release process.
Changes
Commit 3430f8f: Apply OIDC Authentication to GitHub Workflow
Modified the GitHub Actions release workflow (.github/workflows/release.yml) to utilize OIDC-based authentication instead of static token authentication:
Added explicit permissions for OIDC token generation:
id-token: write- Enables OIDC token creationcontents: write- Maintains repository write accesspull-requests: write- Preserves PR management capabilitiesRemoved static token authentication: Eliminated the
NODE_AUTH_TOKENenvironment variable that previously relied on theNPM_PUBLISH_TOKENsecretThis transition to OIDC provides enhanced security through short-lived, automatically-managed authentication tokens issued by GitHub's identity provider, eliminating the need for long-lived static credentials.
Commit 587367a: Enable Provenance Attestation
Updated the
publishConfigsection across all 16 publishable packages in the monorepo to include"provenance": true:Enabling provenance attestation provides cryptographically verifiable information about the build and publishing process, allowing package consumers to verify the authenticity and origin of published artifacts through npm's supply chain transparency features.
Benefits