ci: add preflight gate and OIDC trusted publishing to npm release
Co-Authored-By: siGit Code <noreply@sigit.si>
Seto Elkahfi committed
Sep 6, 2026 at 09:56 UTC
7097dded2eabca10eaf66431042bcdff0162f516
1 file changed
+20
-11
.github/workflows/release-sdk-npm.yml
+20
-11
@@ -81,11 +81,24 @@ jobs:
81
run: npm pack --dry-run
82
83
# ── Publish to npm (tag push only) ────────────────────────────────────────
84
+ #
85
+ # Publishing uses npm trusted publishing (OIDC), not a long-lived token.
86
+ # The npm side is configured at
87
+ # npmjs.com/package/@ondeinference/react-native/access
88
+ # with the trusted publisher: repo ondeinference/onde, workflow
89
+ # release-sdk-npm.yml, environment release-sdk-npm. All three must keep
90
+ # matching what this job declares below, or npm answers the publish with a
91
+ # 404 on PUT.
92
publish:
93
name: Publish to npm
94
needs: validate
95
runs-on: ubuntu-latest
96
if: startsWith(github.ref, 'refs/tags/')
97
+ environment: release-sdk-npm
98
+
99
+ permissions:
100
+ contents: read
101
+ id-token: write
102
103
env:
104
GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}
@@ -103,6 +116,13 @@ jobs:
116
node-version: 22
117
registry-url: "https://registry.npmjs.org"
118
119
+ # Node 22 ships npm 10, which predates OIDC publishing. Trusted
120
+ # publishing needs npm 11.5.1 or newer.
121
+ - name: Upgrade npm for trusted publishing
122
+ run: |
123
+ npm install -g npm@latest
124
+ npm --version
125
+
126
- name: Install dependencies
127
working-directory: sdk/react-native
128
run: npm install
@@ -111,19 +131,8 @@ jobs:
131
working-directory: sdk/react-native
132
run: npm run build
133
114
- # ── Publish ────────────────────────────────────────────────────────────
115
- # NPM_TOKEN must be a repository secret containing an npm access token
116
- # with publish permissions for the @ondeinference scope.
117
- #
118
- # To obtain the token:
119
- # 1. Log in to https://www.npmjs.com as a member of the @ondeinference org.
120
- # 2. Go to Access Tokens → Generate New Token → Granular Access Token.
121
- # 3. Scope it to the @ondeinference org with read+write packages.
122
- # 4. Add it as a repository secret named NPM_TOKEN on the onde repo.
134
- name: Publish @ondeinference/react-native to npm
135
working-directory: sdk/react-native
125
- env:
126
- NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
136
run: |
137
npm_package_name=$(node -p "require('./package.json').name")
138
npm_package_version=$(node -p "require('./package.json').version")