Skip to content

ci: add OIDC Trusted Publishing w/ Github Environments #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ericcrosson-bitgo merged 1 commit into from
Nov 13, 2025
Merged

ci: add OIDC Trusted Publishing w/ Github Environments #40

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ on:

jobs:
release:
uses: semantic-release-action/typescript/.github/workflows/release.yml@70c4b6f612fd516692472d20eac1c590ac08cd20 # v3.1.0
uses: semantic-release-action/typescript/.github/workflows/release.yml@fd8c4abce3b0710e4e0d0ecf17fdaf2e770d4c82 # v3.2.0-beta.1
Copy link
Copy Markdown

@ericcrosson-bitgo ericcrosson-bitgo Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How long will this repo rely on a beta version of semantic-release-action/typescript? What's the path to getting onto a non-beta release?

Copy link
Copy Markdown
Author

@tanjeemh tanjeemh Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As soon as we can confirm publishing through the environment works, it will be as simple as pushing beta to master in semantic-release-action/typescript, and opening a PR that reflects the changes here in io-ts.
Super quick implementation

Copy link
Copy Markdown

@ericcrosson-bitgo ericcrosson-bitgo Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As soon as we can confirm publishing through the environment works

What is the path to doing this though? I'm confused because this PR is against master and does not trigger a release. (Good, because we don't want to make a release to the default distribution channel in this package.) But then, how will we confirm if publishing through the environment works?

Copy link
Copy Markdown
Author

@tanjeemh tanjeemh Nov 13, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I understand your confusion. My understanding is that the release check will run and prompt us to authenticate using the publish environment.
However because we are using the "ci:" prefix, we should see a message in the logs similar to:

ci: add OIDC Trusted Publishing w/ Github Environments
[semantic-release] Release will not trigger due to "ci" prefix

So the purpose of this PR is to check that the release.yaml will trigger a deployment confirmation in the publish environment. If we can get the green checkmark on this, thats all we need to ensure that OIDC Trusted Publishing will work.

This is actually intended, because I want to test the edge case of what would happen if someone did everything correctly - they push to the deployment branch specified in the Github Environment, they get an approval from a required reviewer, BUT they don't use the correct prefix (fix, feat, etc.); hence it should not release to npmjs.

I don't believe this edge case has been tested yet, and I think would be very useful information.

Copy link
Copy Markdown

@ericcrosson-bitgo ericcrosson-bitgo Nov 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All right, sure. Thanks for clearing that up!

with:
disable-semantic-release-git: true
environment: publish