Skip to content

Move deployment from npm access tokens to trusted publishing #1990

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cafour wants to merge 12 commits into
base: main
Choose a base branch
from
Open

Move deployment from npm access tokens to trusted publishing #1990

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
3b4f96b
Move to npm trusted publishing (and add a dry run option) in publish-…
cafour Jan 30, 2026
9e6a381
Fix publish-public.yml
cafour Jan 30, 2026
bf26e6f
Fix publish-public.yml (2)
cafour Jan 30, 2026
e4bd6d6
Fix publish-public.yml (3)
cafour Jan 30, 2026
7f5f988
Fix publish-public.yml (4)
cafour Jan 30, 2026
114fe96
Fix publish-public.yml (5)
cafour Jan 30, 2026
2e4be2b
Fix publish-public.yml (6)
cafour Jan 30, 2026
ffaf6a3
Fix publish-public.yml (7)
cafour Jan 30, 2026
3641408
Fix publish-public.yml (8)
cafour Jan 30, 2026
2897178
Fix publish-public.yml (9)
cafour Jan 30, 2026
5e5c7ab
Fix publish-public.yml (10)
cafour Jan 30, 2026
5c5a9a2
Fix publish-public.yml (11)
cafour Jan 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 18 additions & 11 deletions .github/workflows/publish-public.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,14 @@ on:
default: ""
description: The version of the packages to publish publicly
required: false
dry-run:
type: boolean
default: false
description: Run the pipeline but don't actually publish anything.

permissions:
id-token: write # Required for OIDC
contents: read

jobs:
copy-nuget-packages:
Expand Down Expand Up @@ -46,7 +54,8 @@ jobs:
-nuGetOrgApiKey "${{ secrets.NUGET_ORG_API_KEY }}" `
-include '${{ inputs.include }}' `
-exclude '${{ inputs.exclude }}' `
-version "${{ inputs.version }}"
-version '${{ inputs.version }}' `
-dryRun ${{ inputs.dry-run && '$true' || '$false' }}
shell: pwsh

copy-npm-packages:
Expand Down Expand Up @@ -90,17 +99,15 @@ jobs:
ls
working-directory: ./artifacts

- name: Set public npm registry
if: steps.include-check.outputs.match == 'true'
run: >
${{ github.workspace }}/ci/scripts/Set-NpmRegistry.ps1 `
-targetDirectory "." `
-registry "https://registry.npmjs.org/" `
-authToken "${{ secrets.PUBLIC_NPM_PAT }}"
shell: pwsh
working-directory: ./artifacts/node_modules/dotvvm-types
- uses: actions/setup-node@v6
with:
node-version: '20'
registry-url: 'https://registry.npmjs.org'

- name: Upgrade npm
run: npm install -g npm@latest

- name: Publish dotvvm-types to registry.npmjs.org
if: steps.include-check.outputs.match == 'true'
run: npm publish --verbose
run: NODE_AUTH_TOKEN="" npm publish --verbose ${{ inputs.dry-run && '--dry-run' || '' }} --tag latest
working-directory: ./artifacts/node_modules/dotvvm-types
15 changes: 10 additions & 5 deletions ci/scripts/Copy-NuGetPackages.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@ param(
[string]$internalNuGetFeedName = "riganti",
[string]$include = "*",
[string]$exclude = "",
[string]$version = ""
[string]$version = "",
[bool]$dryRun = $false
)

if (-not (Test-Path "$root")) {
Expand Down Expand Up @@ -73,10 +74,14 @@ try {
Write-Host "::group::Pushing packages to NuGet.org"
try {
foreach ($package in (Get-ChildItem "$packagesDir/**/*.nupkg")) {
nuget push "$($package.FullName)" `
-Source "nuget.org" `
-ApiKey "$nuGetOrgApiKey" `
-NonInteractive
if (!($dryRun)) {
nuget push "$($package.FullName)" `
-Source "nuget.org" `
-ApiKey "$nuGetOrgApiKey" `
-NonInteractive
} else {
Write-Host "Skipping 'nuget push' because dry run is active."
}
}
} finally {
Write-Host "::endgroup::"
Expand Down
6 changes: 6 additions & 0 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading