modify release.yml to include new npm granular access token #175
Conversation
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
WalkthroughThe pull request updates the GitHub Actions release workflow: upgrades action versions to v4, adds workflow permissions ( Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Compliance Guide 🔍Below is a summary of compliance checks for this PR:
Compliance status legend🟢 - Fully Compliant🟡 - Partial Compliant 🔴 - Not Compliant ⚪ - Requires Further Human Verification 🏷️ - Compliance label |
||||||||||||||||||||||||||
PR Code Suggestions ✨Explore these optional code suggestions:
|
|||||||||
codeant-ai
bot
added
the
size:XS
|
CodeAnt AI finished reviewing your PR. |
|
PR Summary: Summary: Update release GitHub Action to use newer actions, grant OIDC permission, switch to npm-based CI/publish, and mark the NPM token as a granular token. Changes:
|
![pantoaibot[bot]](https://avatars.githubusercontent.com/in/934356?s=60&v=4){kind=small}
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: ${{ env.NODE_JS_VERSION }} |
There was a problem hiding this comment.
[CRITICAL_BUG] The step uses node-version: ${{ env.NODE_JS_VERSION }} but the global env: NODE_JS_VERSION was removed in this change. This will make actions/setup-node receive an empty/undefined value and likely fail. Restore the env block (env: NODE_JS_VERSION: 20.19.5) at the top of the workflow or replace the reference with a concrete value (e.g. node-version: '20.19.5') so the runner has a deterministic Node version.
name: release
env:
NODE_JS_VERSION: 20.19.5
on:
release:
types: [created]
jobs:
release:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write # Required for OIDC
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_JS_VERSION }}
registry-url: 'https://registry.npmjs.org'
- run: npm ci
- run: yarn prepare
- run: npm publish --access public --provenance
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # Granular token
| - run: npm ci | ||
| - run: yarn prepare |
There was a problem hiding this comment.
[REFACTORING] This workflow mixes package managers: it runs npm ci (line 17) then yarn prepare (line 18). Mixing npm and yarn can cause inconsistent dependency resolution (different lockfiles, caches). Choose one install strategy and keep steps consistent: either run npm ci && npm run prepare (if prepare script exists) or use yarn install --frozen-lockfile && yarn prepare. Also align with other workflows (ci.yml uses yarn install) to avoid environment drift.
- uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_JS_VERSION }}
registry-url: 'https://registry.npmjs.org'
- run: yarn install --frozen-lockfile
- run: yarn prepare
- run: npm publish --access public --provenance
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # Granular token
|
Reviewed up to commit:70e3539b532439fa6c270476fc75c617779ad828 Additional Suggestion.github/workflows/release.yml, line:19You added --provenance to npm publish. Ensure the Node/npm version provided by actions/setup-node supports the --provenance flag (npm versions vary by Node). If you keep the env var removal, the node/npm version may change unexpectedly. Either pin a supported Node version or remove the flag if the runner's npm doesn't support it. - uses: actions/setup-node@v4
with:
node-version: 20.19.5
registry-url: 'https://registry.npmjs.org'
- run: npm ci
- run: yarn prepare
- run: npm publish --access public --provenance
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # Granular token.github/workflows/release.yml, line:8-10You added a job-level permissions block (contents: read, id-token: write). Confirm these are the least privileges required: id-token: write is needed only when using OIDC flows; if you are not using OIDC in this workflow you can remove it. If the intention is to use OIDC for publishing, add the corresponding OIDC auth step and documentation. Also consider placing permissions at workflow-level if they are intended to apply to all jobs.jobs:
release:
runs-on: ubuntu-latest
permissions:
contents: read
# id-token: write # Enable only if using OIDC for npm publishing
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_JS_VERSION }}
registry-url: 'https://registry.npmjs.org'
- run: npm ci
- run: yarn prepare
- run: npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} # Granular token |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/release.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: test-ios
- GitHub Check: test-android
🔇 Additional comments (1)
.github/workflows/release.yml (1)
8-10: Permissions and action upgrades look solid.Adding
id-token: writepermission is required for OIDC support, which is necessary for the--provenanceflag in npm v9.5+. The action version upgrades to v4 are current and recommended.Also applies to: 12-13
| - run: npm ci | ||
| - run: yarn prepare | ||
| - run: npm ci --legacy-peer-deps | ||
| - run: npm publish --access public | ||
| - run: npm publish --access public --provenance |
There was a problem hiding this comment.
Inconsistent package manager: yarn used alongside npm in workflow.
Line 17 switches to npm ci, but line 18 still uses yarn prepare. If yarn is not available in the CI environment, this step will fail. Either:
- Switch line 18 to
npm run prepare(if prepare is defined in package.json scripts) - Or keep yarn installed and update line 17 to use
yarn install --frozen-lockfile
This is likely an incomplete migration from yarn to npm.
Apply one of the following fixes:
Option 1: Replace yarn with npm equivalent (recommended)
- run: npm ci
- - run: yarn prepare
+ - run: npm run prepare
- run: npm publish --access public --provenanceOption 2: Revert to yarn-based approach
- - run: npm ci
+ - run: yarn install --frozen-lockfile
- run: yarn prepare
- run: npm publish --access public --provenance📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - run: npm ci | |
| - run: yarn prepare | |
| - run: npm ci --legacy-peer-deps | |
| - run: npm publish --access public | |
| - run: npm publish --access public --provenance | |
| - run: npm ci | |
| - run: npm run prepare | |
| - run: npm publish --access public --provenance |
| - run: npm ci | |
| - run: yarn prepare | |
| - run: npm ci --legacy-peer-deps | |
| - run: npm publish --access public | |
| - run: npm publish --access public --provenance | |
| - run: yarn install --frozen-lockfile | |
| - run: yarn prepare | |
| - run: npm publish --access public --provenance |
🤖 Prompt for AI Agents
.github/workflows/release.yml lines 17-19: the workflow mixes npm and yarn (uses
`npm ci` then `yarn prepare`), which can fail if yarn is not available; fix by
either (preferred) replacing the yarn call with the npm equivalent: change `yarn
prepare` to `npm run prepare` (ensure a prepare script exists in package.json),
or if you intend to use yarn across the job, replace `npm ci` with `yarn install
--frozen-lockfile` and ensure subsequent steps use yarn consistently.
User description
PR Type
Enhancement
Description
Update GitHub Actions workflow to use OIDC for npm publishing
Replace deprecated action versions with latest releases
Add granular npm token support with provenance
Simplify dependency installation and formatting
Diagram Walkthrough
File Walkthrough
release.yml
Update release workflow for OIDC npm publishing.github/workflows/release.yml
id-token: write) for secure npm publishingsetup-node
yarn install --frozen-lockfilewithnpm cifor consistency--provenanceflag tonpm publishcommand for granular tokensupport
NODE_JS_VERSIONenvironment variable declarationCodeAnt-AI Description
Use OIDC-based npm publishing with provenance and update release workflow
What Changed
Impact
✅ OIDC-based npm publishing✅ Granular npm tokens for releases✅ Reproducible release installs💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.