From a3f878d2c597d653229b0e662744bdc409fdc4d0 Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 4 Oct 2026 14:11:14 +0300 Subject: [PATCH 1/2] chore(ci): adopt putio-ci credential names --- .github/workflows/ci.yml | 4 ++-- docs/DISTRIBUTION.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a6b6539..af2da64 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -47,6 +47,6 @@ jobs: permissions: contents: read id-token: write - uses: putdotio/.github/.github/workflows/frontend-release-npm.yml@8240b79dee9e0933c757bca249c82daa698d9c47 # v1.0.2 + uses: putdotio/.github/.github/workflows/frontend-release-npm.yml@aebc5c2313cce5d667477d1a48d30a6f2eb4bc31 # putio-ci credential rename secrets: - PUTIO_RELEASE_BOT_PRIVATE_KEY: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }} + PUTIO_CI_APP_PRIVATE_KEY: ${{ secrets.PUTIO_CI_APP_PRIVATE_KEY }} diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index 550808b..e675f4c 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -19,14 +19,14 @@ The release job uses the `release` GitHub Environment with `deployment: false`. Required protected inputs: -- `PUTIO_RELEASE_BOT_CLIENT_ID` as a repository or Environment variable -- `PUTIO_RELEASE_BOT_PRIVATE_KEY` as an Environment secret +- `PUTIO_CI_APP_CLIENT_ID` as a repository or Environment variable +- `PUTIO_CI_APP_PRIVATE_KEY` as an Environment secret The npm package uses Trusted Publishing from GitHub Actions. On npm, configure owner `putdotio`, repository `rokit`, workflow `ci.yml`, and Environment named `release` for the package. During the `@semantic-release/npm` publish step, npm detects the GitHub OIDC identity, mints short-lived publish credentials, and publishes provenance for the release job. -Release writes use the `putio-releaser` installation token. The default `GITHUB_TOKEN` remains read-only, and the release bot token is minted only after dependencies are installed. +Release writes use the `putio-ci` installation token. The default `GITHUB_TOKEN` remains read-only, and the release bot token is minted only after dependencies are installed. ## Package Contents From 37e1c85646a6ec168b6d27557ad3244a4286bfd0 Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 4 Oct 2026 14:15:22 +0300 Subject: [PATCH 2/2] docs: clarify reviewed release workflow pin --- docs/DISTRIBUTION.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index e675f4c..01e19f3 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -11,7 +11,7 @@ Merges to `main` are considered publishable. The CI workflow runs: semantic-release analyzes Conventional Commits; a releasable commit publishes to npm, creates a GitHub Release, and commits the released `package.json` version back to `main` with `[skip ci]`. -The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a tagged commit; the semantic-release action and plugin pins live there. [`scan.yml`](https://github.com/putdotio/rokit/blob/main/.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch. +The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a reviewed commit SHA; the semantic-release action and plugin pins live there. [`scan.yml`](https://github.com/putdotio/rokit/blob/main/.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch. ## Release Credentials