Skip to content

Set up npm trusted publisher#1

Merged
fregante merged 4 commits intomainfrom
copilot/set-up-trusted-publisher-workflow
Apr 30, 2026
Merged

Set up npm trusted publisher#1
fregante merged 4 commits intomainfrom
copilot/set-up-trusted-publisher-workflow

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 25, 2026

  • Add id-token: write permission for npm trusted publisher
  • Add --provenance flag to npm publish
  • Use Node.js 22 in actions/setup-node

@fregante fregante changed the title Set up npm trusted publisher, update action references, migrate repo URLs to refined-github Set up npm trusted publisher Apr 25, 2026
@fregante fregante marked this pull request as ready for review April 25, 2026 12:07
@fregante fregante requested a review from SunsetTechuila April 25, 2026 12:16
@fregante
Copy link
Copy Markdown
Member

@SunsetTechuila new repo in the org!

with:
registry-url: 'https://registry.npmjs.org'
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@fregante
Copy link
Copy Markdown
Member

@copilot use node 22 in setup-node

Copy link
Copy Markdown
Contributor Author

Copilot AI commented Apr 25, 2026

@copilot use node 22 in setup-node

Done in 19ea06f.

Copilot AI requested a review from fregante April 25, 2026 12:56
- uses: actions/setup-node@v6
with:
registry-url: 'https://registry.npmjs.org'
node-version: '22'
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would use

Suggested change
node-version: '22'
node-version: lts/*

Copy link
Copy Markdown
Member

@fregante fregante Apr 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a temporary workaround, we should prefer setting the engine field. Here we can't set it because it would be a breaking change and we're just following the source package's versioning.

They're not too far behind though, so soon: https://github.com/primer/octicons/blob/711ef28bd38aecc89380c5183caa91014f85c8f8/.github/workflows/ci.yml#L15

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually ☝️🤓 we should prefer devEngines.runtime. I never suggested it because fnm still doesn't support it 😭: Schniz/fnm#1433

Copy link
Copy Markdown
Member

@fregante fregante Apr 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You were right, this is just a publish step, it does not have to follow the project's node version, I just realized 😅

@fregante fregante merged commit 6fdf26e into main Apr 30, 2026
@fregante fregante deleted the copilot/set-up-trusted-publisher-workflow branch April 30, 2026 07:31

if npm version "$(npm info @primer/octicons version)"; then
npm publish
npm publish --provenance
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Weird. It all seems to be correctly configured but it's failing.

Image

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Failure: https://github.com/refined-github/octicons-plain-react/actions/runs/25153190669/job/73728442462

Environment details
  node: v22.22.2
  npm: 10.9.7
  yarn: 1.22.22

The same setup works in https://github.com/refined-github/github-url-detection/actions/workflows/npm-publish.yml

That repo:

  node: v24.14.1
  npm: 11.11.0
  yarn: 1.22.22

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: Trusted publishing requires npm CLI version 11.5.1 or later and Node version 22.14.0 or higher.

https://docs.npmjs.com/trusted-publishers

Copy link
Copy Markdown
Member

@fregante fregante Apr 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The action doesn't allow picking the npm version, so I went ahead and just used 24 like the docs suggest

Screenshot 1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants