Skip to content

Require admin review for workflow changes, gate npm OIDC behind a tag-only environment #1533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
orta merged 1 commit into from
Aug 24, 2026
Merged

Require admin review for workflow changes, gate npm OIDC behind a tag-only environment #1533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Changes to the release automation need sign-off from a repository admin.
# Anyone with write access can open the PR; someone on this list has to approve it.
#
# This list is also what npm's trusted publishing trusts, so treat a change to
# these files as a change to who can ship the `danger` package.
/.github/workflows/ @orta @dbgrandi @KrauseFx @macklinu @f-meloni
/.github/CODEOWNERS @orta @dbgrandi @KrauseFx @macklinu @f-meloni
/.release-it.json @orta @dbgrandi @KrauseFx @macklinu @f-meloni
4 changes: 4 additions & 0 deletions .github/workflows/npm_publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ permissions:
jobs:
publish:
runs-on: ubuntu-latest
# Only tags can deploy to this environment, and only admins can create tags
# (the "Release tags" ruleset). Without it, anyone with write access could
# push a branch with an edited copy of this file and get npm's OIDC creds.
environment: npm-release

steps:
- uses: actions/checkout@v4
Expand Down
6 changes: 5 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,12 +101,16 @@ repository ruleset, so the set of people who can ship a release is that ruleset'

- Checkout the `main` branch. Ensure your working tree is clean, and make sure you have the latest changes by running
`git pull; yarn`.
- Bump and tag - `npm run release -- patch`. This bumps `package.json`, commits, tags and pushes. It no longer publishes
- Bump and tag - `npm run release -- patch --ci`. This bumps `package.json`, commits, tags and pushes. It no longer publishes
to npm from your machine, so there's no OTP to enter.
- Pushing the tag runs [`npm_publish.yml`](.github/workflows/npm_publish.yml), which publishes to npm using npm's
trusted publishing (there is no `NPM_TOKEN` secret) and then kicks off `release.yml` for the macOS native builds and
the homebrew tap.

The publish job runs in the `npm-release` environment, which only tags can deploy to. Combined with the tag ruleset,
that means a branch can never obtain npm's OIDC credentials. Changes to anything under `.github/workflows/` need a
review from an admin, via [CODEOWNERS](.github/CODEOWNERS).

:ship:

## License, Contributor's Guidelines and Code of Conduct
Expand Down
Loading