Skip to content

Commit 909ce5c

Browse files
ryanbas21ryanbas21
authored
Merge pull request #418 from ForgeRock/use-trusted-publishers
ci: use-trusted-publishers
2 parents 4fbb22c + 105551a commit 909ce5c

File tree

2 files changed

+109
-114
lines changed

2 files changed

+109
-114
lines changed

‎.github/workflows/publish.yml‎

Lines changed: 96 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,46 @@ on:
33
push:
44
branches:
55
- main
6+
# allow other workflows to call this one (for snapshots)
7+
workflow_call:
8+
inputs:
9+
branch:
10+
description: 'Branch or ref to publish from'
11+
required: false
12+
type: string
13+
default: 'main'
14+
dist_tag:
15+
description: 'npm dist-tag'
16+
required: false
17+
type: string
18+
default: 'beta'
19+
prerelease:
20+
description: 'changesets prerelease tag (e.g., beta, canary)'
21+
required: false
22+
type: string
23+
default: 'beta'
24+
access:
25+
description: 'npm access'
26+
required: false
27+
type: string
28+
default: 'public'
29+
630
env:
731
NX_CLOUD_ENCRYPTION_KEY: ${{ secrets.NX_CLOUD_ENCRYPTION_KEY }}
832
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
933
NX_CLOUD_DISTRIBUTED_EXECUTION: true
1034
PNPM_CACHE_FOLDER: .pnpm-store
11-
NPM_ACCESS_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
1235
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
1336
CI: true
1437

1538
jobs:
1639
publish-or-pr:
40+
if: github.event_name == 'push'
1741
permissions:
18-
contents: write # to create release (changesets/action)
19-
issues: write # to post issue comments (changesets/action)
20-
pull-requests: write # to create pull request (changesets/action)
21-
id-token: write # give id token write for provenance
42+
contents: write # changesets/action
43+
issues: write
44+
pull-requests: write
45+
id-token: write # OIDC for provenance if npm publish happens here
2246
runs-on: ubuntu-latest
2347
steps:
2448
- uses: actions/checkout@v4
@@ -36,8 +60,6 @@ jobs:
3660

3761
- run: pnpm install --frozen-lockfile
3862

39-
# This line enables distribution
40-
# The "--stop-agents-after" is optional, but allows idle agents to shut down once the "e2e-ci" targets have been requested
4163
- run: pnpm dlx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yml" --stop-agents-after="e2e-ci" --with-env-vars="CODECOV_TOKEN"
4264

4365
- name: Cache Playwright browsers
@@ -77,11 +99,8 @@ jobs:
7799
commit: 'chore: version-packages'
78100
setupGitUser: true
79101
env:
80-
# See https://github.com/changesets/action/issues/147
81102
HOME: ${{ github.workspace }}
82103
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
83-
NPM_CONFIG_PROVENANCE: 'true'
84-
NPM_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
85104

86105
- name: Send GitHub Action data to a Slack workflow
87106
if: steps.changesets.outputs.published == 'true'
@@ -119,26 +138,85 @@ jobs:
119138
with:
120139
folder: docs
121140
commit-message: 'chore: release-api-docs-beta'
122-
target-folder: 'beta' # we push to beta folder when we are updating "main"
141+
target-folder: 'beta'
123142

124-
# Calculate and save baseline bundle sizes
125143
- name: Calculate baseline bundle sizes
126144
run: |
127145
chmod +x ./scripts/bundle-sizes.sh
128-
129-
# Don't use any previous baseline for main branch - always create fresh
130146
rm -f previous_sizes.json
131-
132147
echo "📊 Calculating fresh baseline bundle sizes for main branch"
133148
./scripts/bundle-sizes.sh
134-
135149
echo "✅ Baseline bundle sizes calculated"
136150
cat previous_sizes.json
137151
138-
# Save baseline for PR comparisons
139152
- name: Upload baseline bundle sizes
140153
uses: actions/upload-artifact@v4
141154
with:
142155
name: bundle-size-baseline
143156
path: previous_sizes.json
144-
retention-days: 30 # Keep baseline for 30 days
157+
retention-days: 30
158+
159+
# --- new reusable job used by the snapshot wrapper ---
160+
trusted-publish:
161+
if: ${{ github.event_name == 'workflow_call' }}
162+
name: Trusted Snapshot Publish
163+
permissions:
164+
contents: write # read+write repo (okay for artifacts/logs)
165+
id-token: write # REQUIRED: OIDC for npm Trusted Publishers
166+
issues: write
167+
pull-requests: write
168+
runs-on: ubuntu-latest
169+
env:
170+
HUSKY: 0
171+
steps:
172+
- uses: actions/checkout@v4
173+
with:
174+
fetch-depth: 0
175+
ref: ${{ inputs.branch }}
176+
- uses: pnpm/action-setup@v4
177+
with:
178+
run_install: false
179+
- uses: actions/setup-node@v4
180+
with:
181+
node-version-file: '.node-version'
182+
cache: 'pnpm'
183+
184+
- run: pnpm install --frozen-lockfile
185+
186+
- run: pnpm dlx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yml" --stop-agents-after="e2e-ci" --with-env-vars="CODECOV_TOKEN"
187+
188+
- name: Cache Playwright browsers
189+
uses: actions/cache@v4
190+
with:
191+
path: ~/.cache/ms-playwright
192+
key: ${{ runner.os }}-playwright-${{ hashFiles('**/pnpm-lock.yaml') }}
193+
restore-keys: |
194+
${{ runner.os }}-playwright-
195+
196+
- run: pnpm exec playwright install
197+
198+
- uses: nrwl/nx-set-shas@v4
199+
with:
200+
main-branch-name: main
201+
202+
- name: setup pnpm config
203+
run: pnpm config set store-dir $PNPM_CACHE_FOLDER
204+
205+
- run: pnpm exec nx run-many -t build test e2e-ci
206+
207+
- uses: actions/upload-artifact@v4
208+
if: ${{ !cancelled() }}
209+
with:
210+
name: playwright-report
211+
path: |
212+
./**/.playwright/**
213+
retention-days: 30
214+
215+
- name: Version Packages as prerelease
216+
run: pnpm changeset version --snapshot ${{ inputs.prerelease }}
217+
env:
218+
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
219+
220+
# The actual npm publish that must occur in the authorized file
221+
- name: Publish packages with dist-tag
222+
run: pnpm publish -r --tag ${{ inputs.dist_tag }} --no-git-checks --access ${{ inputs.access }}

‎.github/workflows/snapshot.yml‎

Lines changed: 13 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -2,107 +2,24 @@ name: Snapshots
22
on:
33
workflow_dispatch:
44
inputs:
5-
registry:
6-
description: 'Npm Registry or Private Registry'
7-
required: false
8-
default: 'https://registry.npmjs.org/'
9-
type: choice
10-
options:
11-
- https://registry.npmjs.org/
12-
- https://npm.petrov.ca
135
branch:
146
description: 'Branch to publish from'
157
required: false
168
default: 'main'
179
type: string
1810

19-
env:
20-
NX_CLOUD_ENCRYPTION_KEY: ${{ secrets.NX_CLOUD_ENCRYPTION_KEY }}
21-
NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
22-
NX_CLOUD_DISTRIBUTED_EXECUTION: true
23-
PNPM_CACHE_FOLDER: .pnpm-store
24-
NPM_ACCESS_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
25-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
26-
HUSKY: 0
27-
2811
jobs:
29-
publish-snapshot:
12+
call-trusted-publish:
13+
name: Call trusted publish (beta dist-tag)
14+
uses: ./.github/workflows/publish.yml
15+
with:
16+
branch: ${{ inputs.branch }}
17+
dist_tag: beta
18+
prerelease: beta
19+
access: public
3020
permissions:
31-
contents: write # to create release (changesets/action)
32-
issues: write # to post issue comments (changesets/action)
33-
pull-requests: write # to create pull request (changesets/action)
34-
id-token: write # give id token write for provenance
35-
runs-on: ubuntu-latest
36-
steps:
37-
- uses: actions/checkout@v4
38-
with:
39-
fetch-depth: 0
40-
ref: ${{ inputs.branch }}
41-
- uses: pnpm/action-setup@v4
42-
with:
43-
run_install: false
44-
- uses: actions/setup-node@v4
45-
id: cache
46-
with:
47-
node-version-file: '.node-version'
48-
cache: 'pnpm'
49-
50-
- run: pnpm install --frozen-lockfile
51-
52-
# This line enables distribution
53-
# The "--stop-agents-after" is optional, but allows idle agents to shut down once the "e2e-ci" targets have been requested
54-
- run: pnpm dlx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yml" --stop-agents-after="e2e-ci" --with-env-vars="CODECOV_TOKEN"
55-
56-
- name: Cache Playwright browsers
57-
uses: actions/cache@v4
58-
with:
59-
path: ~/.cache/ms-playwright
60-
key: ${{ runner.os }}-playwright-${{ hashFiles('**/pnpm-lock.yaml') }}
61-
restore-keys: |
62-
${{ runner.os }}-playwright-
63-
64-
- run: pnpm exec playwright install
65-
66-
- uses: nrwl/nx-set-shas@v4
67-
with:
68-
main-branch-name: main
69-
70-
- name: setup pnpm config
71-
run: pnpm config set store-dir $PNPM_CACHE_FOLDER
72-
73-
- run: pnpm exec nx run-many -t build test e2e-ci
74-
75-
- uses: actions/upload-artifact@v4
76-
if: ${{ !cancelled() }}
77-
with:
78-
name: playwright-report
79-
path: |
80-
./**/.playwright/**
81-
retention-days: 30
82-
83-
- name: Update npmrc
84-
run: |
85-
cat << EOF > ".npmrc"
86-
//registry.npmjs.org/:_authToken=$NPM_TOKEN
87-
//npm.petrov.ca/:_authToken=$NPM_TOKEN
88-
EOF
89-
env:
90-
NPM_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
91-
- name: Version Packages as Beta
92-
run: pnpm changeset version --snapshot beta
93-
env:
94-
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
95-
96-
- name: Publish packages as beta
97-
if: ${{ inputs.registry == 'https://registry.npmjs.org/' }}
98-
run: pnpm publish -r --tag beta --no-git-checks --registry ${{ inputs.registry }}
99-
env:
100-
NPM_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
101-
NPM_CONFIG_PROVENANCE: 'true' # make sure provenance is working on beta releases to npm
102-
103-
- name: Publish packages as beta
104-
if: ${{ inputs.registry != 'https://registry.npmjs.org/' }}
105-
run: pnpm publish -r --tag beta --no-git-checks --registry ${{ inputs.registry }}
106-
env:
107-
NPM_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
108-
NPM_CONFIG_PROVENANCE: false # verdaccio doesn't support provenance
21+
contents: write
22+
id-token: write
23+
issues: write
24+
pull-requests: write
25+
secrets: inherit

0 commit comments

Comments
 (0)