Repository navigation
Conversation
Release publishing now authenticates with npm through OIDC instead of NPM_TOKEN, and every published version carries signed provenance. - release.yml: grant id-token: write, drop the npm token and registry-url, and run in the production-release environment so only main, canary, and rc can publish. - Bump Yarn to 4.18.1 for native OIDC publishing. Keep the pre-4.15 package age gate off and publish to registry.npmjs.org directly. - release:publish requests provenance, skips versions already on npm, and fails early when a package is not on npm yet. - Add yarn release:bootstrap, which publishes a 0.0.0 placeholder for a new package name and adds the trusted publisher config for each package. - Point every package's repository field at its directory in this repo, which npm checks against the publishing workflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kylemcd
requested review from
andy-knock and
meryldakin
and removed request for
a team
November 5, 2026 20:23
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: 37d5de7 The changes in this PR will be included in the next version bump. This PR includes changesets to release 13 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
…rder - Pass --registry to `npm trust` like the other npm calls in the bootstrap, so a different default registry in a maintainer's npm config can't send it elsewhere. - RELEASES.md: restrict the production-release environment before adding trusted publishers, since npm doesn't check the branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1107 +/- ##
=======================================
Coverage 78.48% 78.48%
=======================================
Files 140 140
Lines 4508 4508
Branches 1314 1314
=======================================
Hits 3538 3538
Misses 873 873
Partials 97 97 |
kylemcd
marked this pull request as draft
November 5, 2026 21:31
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Moves npm publishing to trusted publishing (OIDC), so CI no longer needs
NPM_TOKEN. npm stops direct publishes from 2FA-bypass tokens in January 2027. Part of KNO-16634, for KNO-16635.Workflow (
release.yml)id-token: write. The built-inGITHUB_TOKENdrops tocontents: read, because pushes and release PRs already use the knock-eng-bot token.registry-url. Yarn usesnpmAuthTokenahead of OIDC when one is set, andregistry-urlinjects a placeholder token.production-releaseenvironment. npm's trusted publisher config can't check the branch, so this environment's branch policy decides which branches can publish (main, canary, rc).Yarn 4.9.1 → 4.18.1
npmMinimalAgeGate: 0keeps the pre-4.15 install behavior.npmPublishRegistrypublishes to registry.npmjs.org, not the yarnpkg alias.yarn.lockchanges are metadata only (format version and the resolve patch hash).Publishing
release:publishadds--provenance(Yarn doesn't turn it on automatically) and--tolerate-republish.repositoryfield now points at this repo with itsdirectory. npm checks it against the workflow.types,eslint-config, andtypescript-confighad none.yarn release:bootstrap(new,scripts/npm-trusted-publishing.mjs)npm trust github ... --env production-release --allow-publish) for every package, or for the ones you name.0.0.0placeholder so the name exists.--dry-runprints the npm commands without running them. RELEASES.md documents it.Reviewers can skip
.yarn/releases/. It's the vendored Yarn binary.Todos
production-releaseenvironment tomain,canary, andrc, with admin bypass off.rc. The only ruleset targets the default branch.yarn release:bootstrap, then merge the Version PR within 2 days. npm drops a new config that hasn't published by then.NPM_TOKENuntilcanarymergesmain. Canary still authenticates withnpmAuthToken. Remove it after that (KNO-16640).Checklist
🤖 Generated with Claude Code