Skip to content

ci: add release workflow #387

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danielroe merged 1 commit into from
Feb 7, 2026
+40 −0
Merged

ci: add release workflow #387

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
name: release

on:
push:
tags:
- "v*"

# Remove default permissions of GITHUB_TOKEN for security
# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
permissions: {}

jobs:
release:
concurrency:
group: release
permissions:
contents: write
id-token: write
Comment on lines +16 to +18
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Feb 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

id-token: write granted but --provenance not used.

The id-token: write permission is typically requested to enable npm provenance. If that's the intent, --provenance needs to be passed to pnpm publish. If provenance is not intended, this permission should be removed to follow the principle of least privilege.

🔧 Option A: Enable provenance 
       - name: 📦 Release
-        run: pnpm publish --no-git-checks
+        run: pnpm publish --no-git-checks --provenance
🔧 Option B: Remove unnecessary permission 
     permissions:
       contents: write
-      id-token: write
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
contents: write
id-token: write
permissions:
contents: write
🤖 Prompt for AI Agents 
In @.github/workflows/release.yml around lines 16 - 18, The workflow currently
grants the id-token: write permission but never uses npm provenance; either
remove the id-token permission from the permissions block or enable provenance
by adding the --provenance flag to the publish step (the pnpm publish
invocation). Locate the permissions entries (id-token: write) and the publish
command (pnpm publish) and implement one of the two fixes: delete the id-token:
write line to drop unnecessary privilege, or update the pnpm publish command to
include --provenance so the granted id-token is actually used.

runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
fetch-depth: 0
- run: corepack enable
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
with:
node-version: latest

- name: 📦 Install dependencies
run: pnpm install

- name: Build (stub)
run: pnpm dev:prepare

- name: 🛠 Build project
run: pnpm build

- name: 📦 Release
run: pnpm publish --no-git-checks
Comment on lines +39 to +40
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Feb 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

pnpm publish will fail — no npm authentication is configured.

The publish step has no NODE_AUTH_TOKEN (or NPM_TOKEN) environment variable, and actions/setup-node is not configured with a registry-url. Without both of these, the publish command will fail with an authentication error.

🔧 Proposed fix: configure registry auth

First, add registry-url to the setup-node step:

       - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: latest
+          registry-url: "https://registry.npmjs.org"

Then, add the token to the publish step:

       - name: 📦 Release
         run: pnpm publish --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: 📦 Release
run: pnpm publish --no-git-checks
- name: 📦 Release
run: pnpm publish --no-git-checks
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
🤖 Prompt for AI Agents 
In @.github/workflows/release.yml around lines 39 - 40, The Release job's
publish step (step name "📦 Release", command "pnpm publish --no-git-checks")
will fail because npm authentication isn't configured; update the workflow to
configure registry auth by modifying the actions/setup-node step (the setup-node
action) to include a registry-url for your npm registry and ensure the publish
step uses a token (set NODE_AUTH_TOKEN or NPM_TOKEN as a secret) in its env so
pnpm can authenticate when running pnpm publish.