Skip to content

ci(release): use GITHUB_TOKEN and npm trusted publishing on release/rc - #345

Merged
hjalmers merged 1 commit into
release/rcfrom
fix/rc-release-pipeline
Oct 4, 2026
Merged

hjalmers merged 1 commit into
release/rcfrom
fix/rc-release-pipeline

Conversation

@hjalmers

@hjalmers hjalmers commented Oct 3, 2026

Copy link
Copy Markdown
Owner

Summary

Fixes the semantic-release step that failed on the release/rc push after #344 was merged (CI run 129), so 5.0.0-rc.21 was never published. The same step had been failing on every push to this branch; it is also why run 127 on the #344 fix branch was red.

Two independent causes, both stale config relative to main:

  1. ERELEASEBRANCHES – "Your configuration for the problematic branches is []". release.branches in package.json still named master as the release branch. That branch no longer exists (the default branch is main), so semantic-release had zero release branches after filtering against the remote and refused to run.
  2. 401 Bad credentials from @semantic-release/github. The workflow authenticated with the GH_TOKEN repository secret, which is no longer valid. main stopped using it in favour of the built-in GITHUB_TOKEN plus OIDC trusted publishing to npm (no NPM_TOKEN), which is how 5.1.2 was published.

Changes

Brings the rc line in line with main's release setup; no library code is touched.

  • package.json: release.branches "master" → "main"; semantic-release ^19.0.5 → ^25.0.3 (its npm plugin publishes via OIDC and bundles npm 11).
  • package-lock.json: regenerated for the new semantic-release tree. Angular 15.1.x, CLI, ng-packagr, TypeScript 4.9.4, Storybook 6.5.15, webpack 5.75, eslint and prettier pins are unchanged.
  • .nvmrc: 22, used by setup-node (the branch already builds on Node 22 in CI).
  • .github/workflows/main.yml: checkout@v4 + setup-node@v4, explicit permissions (contents, issues, pull-requests, id-token: write), GITHUB_TOKEN instead of GH_TOKEN/NPM_TOKEN, github-pages-deploy-action@v4 deploying Storybook into the gh-pages/rc folder (the folder main's deploy preserves via clean-exclude), and the deploy + release steps gated on refs/heads/release/rc so feature-branch pushes only build. Removed the deprecated set-output branch step and the release-info-action step, which were unused.

Verification

  • npm ci --legacy-peer-deps from a clean tree installs the new lockfile; npm run build and npm run build-storybook pass.

  • semantic-release --dry-run --no-ci on the fix branch resolves the branch config (4.x, 5.x, main, release/rc) and exits 0 instead of throwing ERELEASEBRANCHES.

  • The same dry run on a local branch named release/rc at this commit (commit-analyzer + release-notes plugins only, nothing pushed or published) reports:

    Found git tag v5.0.0-rc.20 associated with version 5.0.0-rc.20 on branch release/rc
    Analysis of 3 commits complete: patch release
    The next release version is 5.0.0-rc.21
    Published release 5.0.0-rc.21 on rc channel   (dry-run)
    

Release

Merging this PR triggers the workflow on release/rc, which should publish 5.0.0-rc.21 (the sort fix from #344) to the npm rc dist-tag and create the GitHub release. If npm's trusted publisher for @angular-generic-table/core is restricted to a GitHub environment, the publish step will say so and the job needs that environment: added.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QHoGUgdEaYbnkn84rpkGHw


Generated by Claude Code

The semantic-release step failed on every push to release/rc since the
default branch was renamed: the release config still listed "master" as
the release branch, so semantic-release found no release branch at all
(ERELEASEBRANCHES), and the workflow authenticated with the stale
GH_TOKEN secret (401 Bad credentials). As a result 5.0.0-rc.21 was never
published after the sort fix was merged.

Bring the rc line in line with main:

- release.branches: "master" -> "main"
- semantic-release ^19 -> ^25, whose npm plugin publishes via OIDC
  trusted publishing (id-token: write) instead of NPM_TOKEN
- workflow: checkout@v4 + setup-node@v4 pinned by .nvmrc (Node 22),
  built-in GITHUB_TOKEN with explicit permissions, github-pages-deploy
  v4 into the gh-pages/rc folder, and gate deploy + release on
  release/rc so feature-branch pushes no longer run them
- regenerate package-lock.json for the new semantic-release tree; the
  Angular, Storybook and lint dependency versions are unchanged

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QHoGUgdEaYbnkn84rpkGHw
@hjalmers
hjalmers merged commit 177b82d into release/rc Oct 4, 2026
2 checks passed
@github-actions

github-actions Bot commented Oct 4, 2026

Copy link
Copy Markdown

🎉 This PR is included in version 5.0.0-rc.21 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants