fix: Replace reusable workflow with standalone canary release #1189

tokio-on-jupiter · 2026-01-23T19:42:13Z

Summary

The sdk repo is public and cannot access private reusable workflows from github-internal. The previous PR #1187 added a reusable workflow reference that fails with "workflow was not found" error.

This PR replaces the reusable workflow reference with a standalone implementation adapted for this Lerna monorepo, with security hardening for public repositories.

Security Features

1. Actor Validation (Immediate Protection)

Only OWNER, MEMBER, or COLLABORATOR can trigger /canary-release
Unauthorized users receive a thumbs-down reaction and explanatory comment
Author association is logged for audit trail

2. Environment Protection (Configurable)

Workflow uses canary-publish environment
Allows requiring manual approval before secrets are available
Provides additional gate for sensitive operations

Setup Required After Merge

Go to Settings > Environments in this repo
Create environment named canary-publish
(Recommended) Add required reviewers from your team
(Optional) Add deployment branch rules to limit to main

Changes

Adds authorization gate job that checks author_association
Replaces reusable workflow with inline Lerna-based implementation
Uses canary-publish environment for secret protection

Test Plan

Merge this PR
Create canary-publish environment in GitHub Settings
Comment /canary-release on PR feat(PLATENG-800): Replace @lifeomic/alpha with @jupiterone/platform-sdk-fetch #1188 to test the workflow
Verify unauthorized users are blocked
Verify canary packages are published to npm

The sdk repo is public and cannot access private reusable workflows from github-internal. This replaces the reusable workflow reference with a standalone implementation that works for public repositories. Uses Lerna for: - Detecting changed packages - Bumping versions with canary prerelease - Publishing with canary dist-tag

Copilot

Pull request overview

This PR replaces a private reusable workflow reference with a standalone canary release workflow implementation. The previous implementation referenced a private workflow from jupiterone/github-internal which is inaccessible from this public repository.

Changes:

Replaced reusable workflow with inline canary release implementation
Added Lerna-based package detection, versioning, and publishing steps
Implemented GitHub reactions and comments for workflow status feedback

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-23T19:43:08Z

.github/workflows/canary.yaml

+          PREID="canary-${{ github.event.issue.number }}-${{ github.run_attempt }}"
+
+          # Version bump with canary prerelease
+          npx lerna version prerelease --preid "$PREID" --no-git-tag-version --no-push --yes


The variable PREID uses an abbreviation that may not be immediately clear to all developers. Consider renaming to PRERELEASE_ID for better clarity.

Suggested change

PREID="canary-${{ github.event.issue.number }}-${{ github.run_attempt }}"

# Version bump with canary prerelease

npx lerna version prerelease --preid "$PREID" --no-git-tag-version --no-push --yes

PRERELEASE_ID="canary-${{ github.event.issue.number }}-${{ github.run_attempt }}"

# Version bump with canary prerelease

npx lerna version prerelease --preid "$PRERELEASE_ID" --no-git-tag-version --no-push --yes

Copilot · 2026-01-23T19:43:08Z

.github/workflows/canary.yaml

+            const packages = JSON.parse('${{ steps.changed.outputs.packages }}');
+
+            let installCommands = packages.map(pkg => {
+              const pkgJson = require(`${process.env.GITHUB_WORKSPACE}/${pkg.location.replace(process.env.GITHUB_WORKSPACE + '/', '')}/package.json`);


The path construction is overly complex with redundant GITHUB_WORKSPACE replacement. Since pkg.location likely already contains the full path or is relative to GITHUB_WORKSPACE, simplify by using pkg.location directly or just removing the workspace prefix once.

Suggested change

const pkgJson = require(`${process.env.GITHUB_WORKSPACE}/${pkg.location.replace(process.env.GITHUB_WORKSPACE + '/', '')}/package.json`);

const pkgPath = pkg.location.startsWith(process.env.GITHUB_WORKSPACE)

? pkg.location

: `${process.env.GITHUB_WORKSPACE}/${pkg.location}`;

const pkgJson = require(`${pkgPath}/package.json`);

Copilot · 2026-01-23T19:43:09Z

.github/workflows/canary.yaml

+      - name: Configure npm for JupiterOne packages
+        run: |
+          echo "@jupiterone:registry=https://npm.pkg.github.com" >> .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" >> .npmrc


The same NPM_AUTH_TOKEN is being used for both GitHub Packages and the public npm registry. This could be a security concern if the token has broader permissions than needed. Consider using separate tokens (NPM_AUTH_TOKEN for npm and GITHUB_TOKEN or a dedicated token for GitHub Packages) to follow the principle of least privilege.

Suggested change

echo "//npm.pkg.github.com/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" >> .npmrc

echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" >> .npmrc

- Rename PREID to PRERELEASE_ID for better clarity - Simplify path construction in package.json lookup Note: Intentionally keeping NPM_AUTH_TOKEN for GitHub Packages as GITHUB_TOKEN lacks permissions for private @JupiterOne packages

Security improvements for public repository canary releases: 1. Actor validation gate job: - Only OWNER, MEMBER, or COLLABORATOR can trigger releases - Unauthorized attempts get thumbs-down reaction + explanatory comment - Logs author association for audit trail 2. Environment protection: - Adds 'canary-publish' environment requirement - Allows configuring required reviewers in GitHub Settings - Secrets only available when environment rules pass Setup required: - Go to GitHub Settings > Environments - Create 'canary-publish' environment - Add required reviewers (optional but recommended) - Environment protection rules will gate secret access

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-23T19:51:10Z

.github/workflows/canary.yaml

+      - name: Configure npm for JupiterOne packages
+        run: |
+          echo "@jupiterone:registry=https://npm.pkg.github.com" >> .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" >> .npmrc


The same NPM_AUTH_TOKEN is being used for both GitHub Packages registry and the public npm registry. These should typically be different tokens - one for GitHub Packages (@JupiterOne scope) and one for npmjs.org. Using the same token could be a security risk if it grants broader permissions than necessary.

Suggested change

echo "//npm.pkg.github.com/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" >> .npmrc

echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_PACKAGES_NPM_TOKEN }}" >> .npmrc

Copilot · 2026-01-23T19:51:10Z

.github/workflows/canary.yaml

+          VERSIONS=""
+          for pkg in $(echo '${{ steps.changed.outputs.packages }}' | jq -r '.[].name'); do
+            PKG_PATH=$(echo '${{ steps.changed.outputs.packages }}' | jq -r ".[] | select(.name == \"$pkg\") | .location")
+            VERSION=$(cat "$PKG_PATH/package.json" | jq -r '.version')


Using 'cat' and piping to jq is unnecessary. Use 'jq -r .version "$PKG_PATH/package.json"' instead for better performance and clarity.

Suggested change

VERSION=$(cat "$PKG_PATH/package.json" | jq -r '.version')

VERSION=$(jq -r '.version' "$PKG_PATH/package.json")

Addresses Copilot review feedback - jq can read files directly without needing cat, improving performance and clarity.

tokio-on-jupiter requested a review from a team as a code owner January 23, 2026 19:42

Copilot AI review requested due to automatic review settings January 23, 2026 19:42

Copilot AI reviewed Jan 23, 2026

View reviewed changes

tokio-on-jupiter added 2 commits January 23, 2026 13:45

refactor: Address Copilot review feedback

3216eb2

- Rename PREID to PRERELEASE_ID for better clarity - Simplify path construction in package.json lookup Note: Intentionally keeping NPM_AUTH_TOKEN for GitHub Packages as GITHUB_TOKEN lacks permissions for private @JupiterOne packages

Copilot AI review requested due to automatic review settings January 23, 2026 19:50

Copilot AI reviewed Jan 23, 2026

View reviewed changes

refactor: Use jq direct file read instead of cat pipe

e172653

Addresses Copilot review feedback - jq can read files directly without needing cat, improving performance and clarity.

ryanmcafee approved these changes Jan 23, 2026

View reviewed changes

tokio-on-jupiter merged commit 8c2f0b5 into main Jan 23, 2026
8 checks passed

tokio-on-jupiter deleted the fix/standalone-canary-workflow branch January 23, 2026 20:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Replace reusable workflow with standalone canary release #1189

fix: Replace reusable workflow with standalone canary release #1189

tokio-on-jupiter commented Jan 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 23, 2026

Uh oh!

Copilot AI Jan 23, 2026

Uh oh!

Copilot AI Jan 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 23, 2026

Uh oh!

Copilot AI Jan 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-              const pkgJson = require(`${process.env.GITHUB_WORKSPACE}/${pkg.location.replace(process.env.GITHUB_WORKSPACE + '/', '')}/package.json`);
+              const pkgPath = pkg.location.startsWith(process.env.GITHUB_WORKSPACE)
+                ? pkg.location
+                : `${process.env.GITHUB_WORKSPACE}/${pkg.location}`;
+              const pkgJson = require(`${pkgPath}/package.json`);

	echo "//npm.pkg.github.com/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" >> .npmrc
	echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" >> .npmrc

	VERSION=$(cat "$PKG_PATH/package.json" \| jq -r '.version')
	VERSION=$(jq -r '.version' "$PKG_PATH/package.json")

fix: Replace reusable workflow with standalone canary release #1189

fix: Replace reusable workflow with standalone canary release #1189

Conversation

tokio-on-jupiter commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security Features

1. Actor Validation (Immediate Protection)

2. Environment Protection (Configurable)

Setup Required After Merge

Changes

Test Plan

Related

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tokio-on-jupiter commented Jan 23, 2026 •

edited

Loading