Repository navigation
ci: stage-only npm publishing behind a protected environment - #11
Merged
Merged
Conversation
tmack8001
force-pushed
the
claude/fervent-bohr-g2mfh5
branch
from
October 22, 2026 15:32
0ef6f3c to
fb3c83c
Compare
- Publishing and npm rollback run in separate jobs bound to the npm-publish environment, gated on main and on the dispatching actor. Dry runs and GitHub-side rollback never reach NPM_TOKEN. - Release stages with npm stage publish (stage-only token); a maintainer promotes the version with 2FA. Docs describe the flow. - actions/checkout and setup-node bumped to v5. Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01W9Y5xJdDbjzZFbNfVFKS5b
tmack8001
force-pushed
the
claude/fervent-bohr-g2mfh5
branch
from
October 22, 2026 15:32
fb3c83c to
5e09440
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Description
Moves npm publishing and rollback behind a protected
npm-publishenvironment and a maintainer-only gate, and switches publishing to npm's stage-only flow now that direct publishing with bypass-2FA tokens is being removed (January 2027).Type of Change
(CI/release tooling; no runtime code changes.)
Changes Made
actions/checkoutandactions/setup-nodebumped to@v5inci.yml,release.ymlandrollback-release.yml.publish_npmjob bound to thenpm-publishenvironment. The main job builds the tarball and passes it over as an artifact, and no longer needsid-token: write.publish_npmrunsnpm stage publish --access public --provenancewith a stage-onlyNPM_TOKEN; a maintainer promotes it withnpm stage approveand 2FA.inspect(no token, covers dry runs),npm_actions(environment-bound: demote, deprecate, unpublish) andgithub_actions(delete release and tag).github.triggering_actor == 'tmack8001'; the npm jobs also requirerefs/heads/mainand a non-dry run.docs/RELEASING.md: new "Protecting the npm token" section and the two-step stage/approve flow.Platform(s) Affected
(No parser or CLI behaviour changes.)
Testing
npm test)Not run: workflow YAML parses and the job graph was checked, but no workflow has executed on this branch. Known unverified points:
--provenanceonnpm stage publishis not confirmed supported.upload-artifact@v5/download-artifact@v5versions are untested.unpublish_npmmay be rejected by a stage-only token (it can deprecate and move dist-tags).Checklist
Documentation
docs/folderAdditional Notes
Merge before running Release again: the npm jobs only run from
main. Thenpm-publishenvironment (main only, required reviewer, stage-onlyNPM_TOKENas an environment secret) is already set up in repo settings.Generated by Claude Code