Skip to content

Releasing: allow npm publish on a new package's trusted publisher #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SandroMaglione merged 1 commit into from
Oct 18, 2026
Merged

Releasing: allow npm publish on a new package's trusted publisher #53

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,9 +129,19 @@ includes it. For a new `packages/<dir>` (named `@typeonce/<name>`):

3. Configure its trusted publisher with the same values as step 5 (`typeonce-dev`
/ `ritmo` / `release.yml` / environment `npm`), close to the next release:
an unvalidated configuration expires after two days.
an unvalidated configuration expires after two days. Tick **Allow npm
publish**: publishers created since September 2026 allow only
`npm stage publish` by default, and the release workflow runs
`npm publish`, which is then rejected with
`403 OIDC permission denied for this action`. The connection then lists
both `npm publish` and `npm stage publish`, like the existing packages.
4. Release as usual: merge the Version Packages PR, and CI publishes the new
package with the others, with provenance. After that publish succeeds,
package with the others, with provenance. If only the new package failed,
start a fresh run (`gh workflow run release.yml --ref main`) rather than
re-running the failed job: the failed attempt already wrote its provenance
to the transparency log, so a re-run fails with
`TLOG_CREATE_ENTRY_ERROR (409)`, while a new run signs new provenance and
skips the versions already published. After that publish succeeds,
require 2FA and disallow token publishing in the package's npm settings.

## References
Expand Down
Loading