Skip to content

DX-809 update to use preferred OIDC for npm publish in github actions #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lloyd-cio merged 5 commits into from
Nov 24, 2025
+16 −8
Merged

DX-809 update to use preferred OIDC for npm publish in github actions #99

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
866b0f5
DX-809 update to use preferred OIDC for npm publish in github actions
lloyd-cio Nov 20, 2025
ce2e7d3
pare this down to only test npm publishing for now
lloyd-cio Nov 20, 2025
0eeb13f
non dry run to verify publishing works
lloyd-cio Nov 21, 2025
c323558
cleanpu
lloyd-cio Nov 21, 2025
e10ad9c
fix and clean
lloyd-cio Nov 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 16 additions & 8 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,21 +6,31 @@ on:
tags:
- '*'

permissions:
id-token: write
contents: read

jobs:
release:
runs-on: ubuntu-latest
environment: release
env:
AWS_ACCESS_KEY_ID: ${{ secrets.GIST_WEB_AWS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.GIST_WEB_AWS_SECRET_ACCESS_KEY }}
AWS_BUCKET: 'gist-code'
CLOUDFLARE_ACCESS_TOKEN: ${{ secrets.CLOUDFLARE_ACCESS_TOKEN }}
CLOUDFLARE_ZONE_ID: 3310bc68d22035edbc12d5d4a4fd278c
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v2
uses: actions/setup-node@v4
with:
node-version: 20
registry-url: 'https://registry.npmjs.org'

- name: Install npm 11.5.1+ for OIDC support
run: npm install -g npm@latest

- name: Build
shell: bash
run: |
Expand All @@ -41,13 +51,12 @@ jobs:
aws_key_id: ${{ env.AWS_ACCESS_KEY_ID }}
aws_secret_access_key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws_bucket: ${{ env.AWS_BUCKET }}
source_dir: 'dist'
source_dir: 'dist'
destination_dir: ${{ env.AWS_DEST }}
endpoint: 'ams3.digitaloceanspaces.com'
- name: Publish to NPM
uses: JS-DevTools/npm-publish@9ff4ebfbe48473265867fb9608c047e7995edfa3 # v3.1.1
with:
token: ${{ secrets.NPM_TOKEN }}
Comment on lines -48 to -50
Copy link
Contributor Author

@lloyd-cio lloyd-cio Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using standard npm publish to and dropping the no-longer-supported auth tokens - use the OIDC config, instead.

Copy link
Contributor Author

@lloyd-cio lloyd-cio Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any concerns on using the standard npm publish over this custom publish action ?

run: npm publish

- name: Update Cloudflare rules
shell: bash
run: |
Expand Down Expand Up @@ -75,10 +84,9 @@ jobs:
--arg version "$RELEASE_VERSION" \
'(.actions[] | select(.id == "forwarding_url") | .value.url) = "https://code.gist.build/web/" + $version + "/gist.min.js"')


echo "Sending updated rule back to Cloudflare..."
curl -s -X PUT "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/pagerules/$RULE_ID" \
-H "Authorization: Bearer $CLOUDFLARE_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
--data "$UPDATED_RULE"
done
done