ci: configure npm trusted publishing with provenance by serhalp · Pull Request #7061 · netlify/build

serhalp · 2026-05-13T15:43:32Z

Summary

Port release.yml workflow (stable releases) from CircleCI to GitHub Actions
- This ported workflow does not use NPM_TOKEN. It uses Trusted Publishing with an OIDC token. It uses provenance attestation.
Update pre-release.yml custom workflow to use https://pkg.pr.new instead

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c220441c-da69-4778-960f-d1f28fb41202

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/slack-session-78quP

_{Comment @coderabbitai help to get the list of available commands.}

pieh · 2026-05-14T06:10:09Z

+
+  publish:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.releases_created == 'true' }}


on npm publishing flakes when release-please run determine that release was created, but actual publish fails (i.e. some network or npm registry issues) this would mean there is no way to "retry" to actually publish to npm, so this is a change from the way CircleCi workflow works

- Add release.yml workflow using release-please-action for stable releases - Update pre-release.yml with OIDC permissions and --provenance flag - Remove release-please job from CircleCI (update-lockfile stays) https://claude.ai/code/session_011HCWQbTc6LTeMxgdwTH2R6

https://claude.ai/code/session_01ABzhd7XYQi7KMqNYZKfUTr

Pin actions to their full commit SHAs with version comments for security (immutable references) and readability. https://claude.ai/code/session_01HtVRxL8TMLfQTbTvvaLYWz

With id-token: write permission and trusted publishing configured on npmjs.com, npm uses the short-lived OIDC token automatically. NODE_AUTH_TOKEN was bypassing OIDC and using the long-lived token. https://claude.ai/code/session_01NmU7gnap9unNWgcsUyN3J7

pkg-pr-new · 2026-06-24T16:17:34Z

Open in StackBlitz

@netlify/build

npm i https://pkg.pr.new/@netlify/build@7061

@netlify/build-info

npm i https://pkg.pr.new/@netlify/build-info@7061

@netlify/cache-utils

npm i https://pkg.pr.new/@netlify/cache-utils@7061

@netlify/config

npm i https://pkg.pr.new/@netlify/config@7061

@netlify/edge-bundler

npm i https://pkg.pr.new/@netlify/edge-bundler@7061

@netlify/functions-utils

npm i https://pkg.pr.new/@netlify/functions-utils@7061

@netlify/git-utils

npm i https://pkg.pr.new/@netlify/git-utils@7061

@netlify/headers-parser

npm i https://pkg.pr.new/@netlify/headers-parser@7061

@netlify/api

npm i https://pkg.pr.new/@netlify/api@7061

@netlify/nock-udp

npm i https://pkg.pr.new/@netlify/nock-udp@7061

@netlify/opentelemetry-sdk-setup

npm i https://pkg.pr.new/@netlify/opentelemetry-sdk-setup@7061

@netlify/opentelemetry-utils

npm i https://pkg.pr.new/@netlify/opentelemetry-utils@7061

@netlify/redirect-parser

npm i https://pkg.pr.new/@netlify/redirect-parser@7061

@netlify/run-utils

npm i https://pkg.pr.new/@netlify/run-utils@7061

@netlify/zip-it-and-ship-it

npm i https://pkg.pr.new/@netlify/zip-it-and-ship-it@7061

commit: b12382c

serhalp · 2026-06-24T16:42:52Z

-      - checkout
-      - npm-install-deps
-      - run: npm run build
-      - run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc


AFAIK this was never actually needed. possibly copypasta.

I think it might have been needed at least at some point - lerna/lerna#2404 (comment)

But doesn't matter anymore with trusted publishing

github-actions · 2026-06-30T13:19:57Z

📊 Dependency Size Changes

Warning

This PR adds 4.5 MB of new dependencies, which exceeds the threshold of 100 kB.

📦 Package	📏 Size
pkg-pr-new@0.0.75	4.5 MB

Total size change: 4.5 MB

serhalp commented May 13, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

pieh reviewed May 14, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

claude and others added 6 commits June 24, 2026 11:15

fix: apply prettier formatting to CI config files

ba7ee19

https://claude.ai/code/session_01ABzhd7XYQi7KMqNYZKfUTr

chore: pin GHA actions to SHAs in release workflows

24a3130

Pin actions to their full commit SHAs with version comments for security (immutable references) and readability. https://claude.ai/code/session_01HtVRxL8TMLfQTbTvvaLYWz

Apply suggestion from @serhalp

8fb3f2f

ci: replace custom pre-release workflow with pkg.pr.new

76fd373

serhalp force-pushed the claude/slack-session-78quP branch from 10567dd to 76fd373 Compare June 24, 2026 15:33

github-advanced-security AI found potential problems Jun 24, 2026

View reviewed changes

Comment thread .github/workflows/pre-release.yml Fixed

style: reformat

fbe45fb

serhalp changed the title ~~ci: move npm publish to GHA for trusted publishing with provenance~~ ci: configure npm trusted publishing with provenance Jun 24, 2026

ci: specify which packages to publish?

ef89830

github-advanced-security AI found potential problems Jun 24, 2026

View reviewed changes

Comment thread .github/workflows/pre-release.yml Fixed

serhalp commented Jun 24, 2026

View reviewed changes

Merge branch 'main' into claude/slack-session-78quP

b12382c

github-advanced-security AI found potential problems Jun 30, 2026

View reviewed changes

Comment thread .github/workflows/pre-release.yml Outdated

Comment on lines 9 to 22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: configure npm trusted publishing with provenance#7061

ci: configure npm trusted publishing with provenance#7061
serhalp wants to merge 9 commits into
mainfrom
claude/slack-session-78quP

serhalp commented May 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 13, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

pieh May 14, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

serhalp Jun 24, 2026

Uh oh!

pieh Jul 1, 2026

Uh oh!

github-actions Bot commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

serhalp commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

See also

Uh oh!

coderabbitai Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

pieh May 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

serhalp Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

pieh Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 30, 2026

📊 Dependency Size Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

serhalp commented May 13, 2026 •

edited

Loading

coderabbitai Bot commented May 13, 2026 •

edited

Loading

pkg-pr-new Bot commented Jun 24, 2026 •

edited

Loading