Repository navigation
ci: split npm publish and github release into separate jobs - #26
Merged
Merged
Conversation
Last open point of #4: contents: write applied to the whole job, so the publish step and both third-party actions ran with it. Actions has no step-level permissions, so the split is the only way to scope it. npm publish now runs with contents: read + id-token: write and no third-party actions beside it; release creation gets contents: write but installs no dependencies. The OIDC credential and the repo write token no longer share a job. The filename stays as is — npm's trusted publisher config pins the workflow filename, and renaming it would break publishing at the next tag. Job names are not part of that config. Refs #4 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
TimG1804
added a commit
that referenced
this pull request
Sep 18, 2026
Last open point of #4: contents: write applied to the whole job, so the publish step and both third-party actions ran with it. Actions has no step-level permissions, so the split is the only way to scope it. npm publish now runs with contents: read + id-token: write and no third-party actions beside it; release creation gets contents: write but installs no dependencies. The OIDC credential and the repo write token no longer share a job. The filename stays as is — npm's trusted publisher config pins the workflow filename, and renaming it would break publishing at the next tag. Job names are not part of that config. Refs #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the last open point of #4:
contents: writeapplied to the entirejob, so
npm publishand both third-party actions ran with repo writeaccess.
Actions has no step-level permissions, so splitting the job is the only way
to scope it:
publish-npm—contents: read+id-token: write, no third-partyactions beside it
github-release—contents: write, installs no dependenciesThe OIDC credential and the repo write token no longer share a job.
The workflow filename is deliberately unchanged: npm's trusted publisher
config pins it, and renaming would break publishing at the next tag. Job
names are not part of that config.
Note this workflow only runs on tag push, so CI does not exercise it — the
change is verified by inspection and first runs for real at the next release.