Repository navigation
ci: stage npm releases via changesets and OIDC trusted publishing - #1033
Merged
Merged
Conversation
Mirror the staged publishing flow from oms-wallet-typescript-sdk: - Release workflow opens a changesets Release / Deploy PR; merging it runs the release gates, packs every unpublished package with pnpm and sends the tarballs to `npm stage publish` (OIDC, no NPM_TOKEN). A maintainer approves each stage with 2FA. - Workflow-dispatch snapshot path stages all packages under a non-semver dist-tag. - Staging script orders packages dependencies-first (no fixed group here) and is covered by node:test suites run in CI. - Add repository.directory to every published package (required for provenance), .nvmrc (Node 22), changelog-github, shared changeset check. - scripts/configure-npm-trust.sh registers the workflow as a stage-only trusted publisher for all master and v2 packages. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
Apply the 0xPolygon/pipelines fix for GHSA-rxhc-j8g6-h4jp, which the oms-wallet-typescript-sdk workflow this was modelled on predates: - Check out with persist-credentials: false and install with --ignore-scripts, so no token sits in .git/config while dependency code runs. - Run the release gates (build, typecheck, lint, tests) on release-PR merges before the app token is minted; ci:stage-release now only packs and stages. - Mint the token last (create-github-app-token v3.2.0), scoped to contents and pull-requests write, for changesets/action only. Default-deny workflow permissions; snapshot job gets pull-requests: read. - Document the 0xsequence-owned release bot app; Polygon's app is private to the 0xPolygon org. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
5 of 6 tasks
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59d12490a7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
`--allow-stage-publish` only exists in npm >= 11.15; the npm bundled with Node 24.14 is 11.11 and rejects it with EUSAGE. Pin the same npm the release workflow uses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
- prepare-npm-snapshot: reject snapshot tags npm parses as semver ranges (`x`, `v1.x`, `v3`) via semver.validRange, before the release gates run. - stage-npm-packages: the approval summary now lists every unpublished version in dependency order, including ones staged by an earlier, partially failed run, so dependencies are approved first on retries. - configure-npm-trust: a failed fetch, missing ref or empty package list is fatal instead of reporting success. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves npm releases to CI-only staged publishing, mirroring oms-wallet-typescript-sdk:
masterkeeps achangesets: Release / DeployPR up to date.workspace:ranges), and sends the tarballs tonpm stage publishunderlatestvia OIDC trusted publishing (noNPM_TOKEN). Changesets then creates package tags and GitHub Releases.workflow_dispatchwithsnapshot_tagstages a throwaway snapshot of all packages.Differences from the reference repo:
fixedgroup), so the staging script orders packages dependencies-first instead of validating one group version. Snapshots bump every package so they only depend on each other.--ignore-scriptsinstall, gates run before the release bot token is minted, and the token is scoped to contents and pull-requests write forchangesets/actiononly.Also:
repository.directoryon every published package (npm provenance rejects publishes without a matchingrepository.url)..nvmrc(Node 22; staged publishing needs ≥ 22.14), CI install action reads it.@changesets/changelog-githubfor PR/commit links in changelogs; shared changeset check on PRs.scripts/configure-npm-trust.sh: one-time registration of this workflow as a stage-only trusted publisher for all 31 package names acrossmasterandv2.PUBLISHING.mddocuments the flow, approvals, recovery, and setup.Companion PR for
v2(stages underv2-legacyso v2 releases stop movinglatest): see the linked PR.Prerequisites before merging
0xsequencerelease bot GitHub App, install it on this repo, and addCHANGESET_RELEASE_BOT_APP_ID/CHANGESET_RELEASE_BOT_APP_PRIVATE_KEYrepo secrets (Polygon's app is private to0xPolygon)../scripts/configure-npm-trust.sh, then set packages to "Require 2FA and disallow tokens".The first release PR after merge ships
wallet-core@3.0.14(passkey fee options fix, #1031) plus all packages from the unpublished 3.0.13 version commit; approving the 3.x services packages underlatestalso moveslatestback from v2's 2.3.47.Test plan
pnpm test:release: 12 node:test cases for the staging and snapshot scriptsnpm stage: all 14 packages packed, noworkspace:ranges left,repository.directorypresent, correct dependency order, realnpm viewdetection of unpublished versions0.0.0-canary-<ts>changeset versionwith changelog-github:wallet-core@3.0.14entry links Fix fee options stub signature for pending config updates #1031🤖 Generated with Claude Code
https://claude.ai/code/session_014qDHk3SaPaDGpPTU1jjLpz