docs(github-ui-setup): reflect publish.yml inlining (PR #372) - #373
Open
martyy-code wants to merge 1 commit into
Open
docs(github-ui-setup): reflect publish.yml inlining (PR #372)#373martyy-code wants to merge 1 commit into
martyy-code wants to merge 1 commit into
Conversation
The previous runbook described an entrypoint + reusable workflow pattern, which was invalidated by PR #372 (inline publish steps into publish.yml). Root cause of the refactor: - npm Trusted Publishing validates the workflow file containing the 'pnpm changeset publish' step. - With reusable workflows, the OIDC workflow_ref claim pointed to _publish-{release,hotfix,canary}.yml, never to publish.yml. - npm surfaced this as E404 (npm/cli #9088). Updates: - §5 Trusted Publisher: replace the entrypoint + reusable description with the inlined model. Drop the reference to Paige Niedringhaus (the pattern she documents does not work for npm Trusted Publishing as of 2026-08-03). - §5.3 verification: drop the line about reusable workflows inheriting OIDC trust. - §6 Workflow permissions: clarify that publish.yml's jobs declare id-token: write, not just the entrypoint. - §7.2 Code Owners: drop mention of reusable workflows. - §8 verification checklist: add an explicit check that _publish-{release,hotfix,canary}.yml are absent from main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates the GitHub UI runbook to reflect the inlined publish steps pattern from PR #372, replacing the obsolete "entrypoint + reusable workflows" guidance.
Why
PR #372 inlined every publish step into
publish.ymlso the OIDCworkflow_refclaim matches the Trusted Publisher filename registered on npmjs.com. With reusable workflows, the OIDC claim pointed to the reusable file, causing npm to surface a misleadingE404(npm/cli #9088).The runbook still described the entrypoint + reusable pattern, which would mislead anyone following it today.
Changes
publish.yml's jobs declareid-token: write, not just an entrypoint._publish-{release,hotfix,canary}.ymlare absent frommain.Test plan
pnpm turbo type-checkpasses.pnpm turbo lintpasses.Risk
None. Documentation only.
🤖 Generated with Claude Code