Skip to content

Fix releases to use trusted publishing (OIDC) #1379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eddeee888 merged 9 commits into from
Mar 2, 2026
Merged

Fix releases to use trusted publishing (OIDC) #1379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
53ca96d
Update runner node version
eddeee888 Feb 28, 2026
7d76379
Ensure release from release.yml for packages
eddeee888 Feb 28, 2026
924933a
Test release
eddeee888 Feb 28, 2026
cf8f98a
Test config
eddeee888 Feb 28, 2026
8a6338f
Test filename
eddeee888 Mar 2, 2026
1af816b
Test minimum config
eddeee888 Mar 2, 2026
12d5e1d
Apply ideal config
eddeee888 Mar 2, 2026
7d01922
Avoid creating a release, as we only fix publish pipeline
eddeee888 Mar 2, 2026
676d348
Add comment for permissions
eddeee888 Mar 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
- name: Setup env
uses: the-guild-org/shared-config/setup@main
with:
nodeVersion: 18
nodeVersion: 24
- name: Build
run: yarn build
env:
Expand All @@ -63,7 +63,7 @@ jobs:
- name: Setup env
uses: the-guild-org/shared-config/setup@main
with:
nodeVersion: 18
nodeVersion: 24
- name: Build
run: yarn build
env:
Expand Down
10 changes: 0 additions & 10 deletions .github/workflows/pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,3 @@ jobs:
if: ${{ github.event.pull_request.title != 'Upcoming Release Changes' }}
secrets:
githubToken: ${{ secrets.GITHUB_TOKEN }}

release:
uses: the-guild-org/shared-config/.github/workflows/release-snapshot.yml@main
with:
npmTag: alpha
buildScript: build
nodeVersion: 18
secrets:
githubToken: ${{ secrets.GITHUB_TOKEN }}
npmToken: ${{ secrets.NPM_TOKEN }}
36 changes: 36 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
name: release
on:
pull_request: # for snapshot release
branches:
- main

push: # for stable release
branches:
- main

jobs:
release-snapshot:
if: github.event_name == 'pull_request'
uses: the-guild-org/shared-config/.github/workflows/release-snapshot.yml@main
permissions:
id-token: write # allows ODIC publishing
pull-requests: write # allows creating comment with alpha versions
Comment on lines +16 to +17
Copy link
Copy Markdown
Collaborator Author

@eddeee888 eddeee888 Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm giving each workflow its own permissions that they need, for that extra peace of mind

with:
npmTag: alpha
buildScript: build
nodeVersion: 24
secrets:
githubToken: ${{ secrets.GITHUB_TOKEN }}
npmToken: FILLER

release-stable:
if: github.event_name == 'push'
uses: the-guild-org/shared-config/.github/workflows/release-stable.yml@main
permissions:
id-token: write # allows ODIC publishing
with:
releaseScript: release
nodeVersion: 24
secrets:
githubToken: ${{ secrets.GITHUB_TOKEN }}
npmToken: FILLER
15 changes: 0 additions & 15 deletions .github/workflows/release.yml
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion packages/presets/near-operation-file/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
"description": "GraphQL Code Generator preset for generating operation code near the operation file",
"repository": {
"type": "git",
"url": "https://github.com/dotansimha/graphql-code-generator-community.git",
"url": "git+https://github.com/dotansimha/graphql-code-generator-community.git",
Copy link
Copy Markdown
Collaborator Author

@eddeee888 eddeee888 Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a warning when publishing saying we should add git+, so I apply that suggestion here.

"directory": "packages/presets/near-operation-file"
},
"license": "MIT",
Expand Down
Loading