Adopt the shared release workflow with Trusted Publishing - #1155
Merged
lorisleiva merged 1 commit intoSep 14, 2026
Merged
lorisleiva merged 1 commit into
lorisleiva merged 1 commit into
Conversation
This PR replaces the inline release job with a call to the shared workflow from codama-idl/release-tools (v1.3.1), which publishes to npm via Trusted Publishing (OIDC). `NPM_TOKEN` is no longer referenced; `id-token: write` is granted on the caller as npm requires. `publish-packages` becomes `release:publish` and the release-tools dependency is bumped to `v1.3.1` for the `trust-publishers` command. Proven on the renderers-rust-cpi canary (codama-idl/renderers-rust-cpi#118 → `@codama/renderers-rust-cpi@0.1.4` published with SLSA provenance). Before merging #1119, run `pnpm exec release-tools trust-publishers` once from this repository: it configures all 17 public packages (including the freshly bootstrapped `@codama/upgrade`). The release PR #1119 is retitled to `[1.x] Release package` by the next release run; it stays attached (the changesets action matches it by head branch).
|
lorisleiva
marked this pull request as ready for review
September 14, 2026 15:30
lorisleiva
deleted the
09-14-adopt_the_shared_release_workflow_with_trusted_publishing
branch
September 14, 2026 16:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR replaces the inline release job with a call to the shared workflow from codama-idl/release-tools (v1.3.1), which publishes to npm via Trusted Publishing (OIDC).
NPM_TOKENis no longer referenced;id-token: writeis granted on the caller as npm requires.publish-packagesbecomesrelease:publishand the release-tools dependency is bumped tov1.3.1for thetrust-publisherscommand.Proven on the renderers-rust-cpi canary (codama-idl/renderers-rust-cpi#118 →
@codama/renderers-rust-cpi@0.1.4published with SLSA provenance). Before merging #1119, runpnpm exec release-tools trust-publishersonce from this repository: it configures all 17 public packages (including the freshly bootstrapped@codama/upgrade).The release PR #1119 is retitled to
[1.x] Release packageby the next release run; it stays attached (the changesets action matches it by head branch).