Skip to content

ci: test npm trusted publishing on every push #2814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
findolor wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: test npm trusted publishing on every push #2814

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 2 additions & 13 deletions .github/workflows/npm-package-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,9 @@
name: NPM Packages Release
on:
push:
branches:
- main
on: [push]

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Map the workflow file structure first.
ast-grep outline .github/workflows/npm-package-release.yml --view expanded || true

echo
echo "=== File with line numbers (first 360 lines) ==="
nl -ba .github/workflows/npm-package-release.yml | sed -n '1,360p'

echo
echo "=== Search for push/tag filters and release-related steps in workflow files ==="
rg -n --no-heading 'on:|branches:|tags:|push:|release|npm package|Telegram|telegram|tag' .github/workflows -g '*.yml'

Repository: rainlanguage/raindex

Length of output: 304

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Workflow file with line numbers ==="
sed -n '1,360p' .github/workflows/npm-package-release.yml | cat -n

echo
echo "=== Relevant workflow trigger and release-step search ==="
rg -n --no-heading '^(on:|  push:|  branches:|  tags:|.*release|.*Telegram|.*telegram|.*tag)' .github/workflows/npm-package-release.yml

echo
echo "=== Other workflow files mentioning npm-package-release or similar release triggers ==="
rg -n --no-heading 'npm-package-release|on:\s*\[push\]|branches:|tags:' .github/workflows -g '*.yml'

Repository: rainlanguage/raindex

Length of output: 17325

Exclude tag pushes from .github/workflows/npm-package-release.yml:2. on: [push] also runs for tag pushes, and this job publishes before the later git push/release steps. On a detached tag ref, that can leave npm packages published without the matching commit/tag updates; use a branch-only push filter such as on: { push: { branches: ['**'] } }.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/npm-package-release.yml at line 2, Restrict the workflow
trigger in the top-level on configuration to branch pushes only, replacing the
unrestricted push trigger with an equivalent branches filter that matches all
branches. Ensure tag pushes do not start the npm package release job, while
normal branch pushes continue to trigger it.

Source: MCP tools

jobs:
release:
# skip this job if the commit was created by this workflow (prevents infinite loop)
if: ${{ github.ref == 'refs/heads/main' && !startsWith(github.event.head_commit.message, 'NPM Package Release') }}
if: ${{ !startsWith(github.event.head_commit.message, 'NPM Package Release') }}
Comment on lines +2 to +6

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Map the workflow structure first.
ast-grep outline .github/workflows/npm-package-release.yml --view expanded || true

# Read the relevant top section and the release job permissions/guards.
sed -n '1,120p' .github/workflows/npm-package-release.yml

# Find references to branch/ref filters, permissions, and release-related push operations.
rg -n "refs/heads|refs/tags|permissions:|id-token: write|contents: write|NPM Package Release|push:" .github/workflows/npm-package-release.yml

Repository: rainlanguage/raindex

Length of output: 6371

Keep the release job off arbitrary branches. .github/workflows/npm-package-release.yml now runs on every push while still granting id-token: write, contents: write, secrets, and push access. The commit-message check is not a trust boundary, so anyone who can push a branch can execute the privileged publishing path.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/npm-package-release.yml around lines 2 - 6, Restrict the
workflow trigger or the release job condition in the `release` job so it only
runs from the intended protected branch and preserves the existing
commit-message loop prevention. Do not rely on the `head_commit.message` check
as the branch authorization boundary; ensure arbitrary branch pushes cannot
execute the privileged publishing path.

Source: MCP tools

runs-on: ubuntu-latest
permissions:
id-token: write
Expand Down Expand Up @@ -275,11 +272,3 @@ jobs:
ui_components_npm_package_${{ env.UC_NEW_VERSION }}.tgz
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# forwards status to telegram chat if this ci fails or gets canceled, only runs for default branch
- name: Forward CI Status
if: always()
uses: rainlanguage/github-chore/.github/actions/telegram-status-report@main
with:
status: ${{ job.status }}
telegram-bot-token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
telegram-chat-id: ${{ secrets.TELEGRAM_CHAT_ID }}
Loading