From a103d8421e116befd9fde58071df1bfd7d542009 Mon Sep 17 00:00:00 2001 From: Loris Leiva Date: Mon, 14 Sep 2026 16:30:29 +0100 Subject: [PATCH] Adopt the shared release workflow with Trusted Publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR replaces the inline release job with a call to the shared workflow from codama-idl/release-tools (v1.3.1), which publishes to npm via Trusted Publishing (OIDC). `NPM_TOKEN` is no longer referenced; `id-token: write` is granted on the caller as npm requires. `publish-packages` becomes `release:publish` and the release-tools dependency is bumped to `v1.3.1` for the `trust-publishers` command. Proven on the renderers-rust-cpi canary (codama-idl/renderers-rust-cpi#118 → `@codama/renderers-rust-cpi@0.1.4` published with SLSA provenance). Before merging #1119, run `pnpm exec release-tools trust-publishers` once from this repository: it configures all 17 public packages (including the freshly bootstrapped `@codama/upgrade`). The release PR #1119 is retitled to `[1.x] Release package` by the next release run; it stays attached (the changesets action matches it by head branch). --- .github/workflows/main.yml | 48 +++++--------------------------------- package.json | 4 ++-- pnpm-lock.yaml | 10 ++++---- 3 files changed, 13 insertions(+), 49 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 547fe1d08..f587a7d7e 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -17,7 +17,6 @@ env: # Among other things, opts out of Turborepo telemetry. See https://consoledonottrack.com/. DO_NOT_TRACK: '1' NODE_VERSION: 24 - RELEASE_VERSION: 1.x jobs: lint: @@ -77,51 +76,16 @@ jobs: release: name: Release - runs-on: ubuntu-latest - if: github.event_name == 'push' needs: [lint, tests] + if: github.event_name == 'push' permissions: contents: write pull-requests: write - outputs: - published: ${{ steps.changesets.outputs.published }} - steps: - - name: Create GitHub App token - id: app-token - uses: actions/create-github-app-token@v3 - with: - client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }} - private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} - - - name: Checkout - uses: actions/checkout@v7 - with: - token: ${{ steps.app-token.outputs.token }} - - - name: Set up pnpm - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - - name: Set up Node.js - uses: actions/setup-node@v7 - with: - node-version: ${{ env.NODE_VERSION }} - cache: pnpm - registry-url: 'https://registry.npmjs.org' - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - - name: Create Release Pull Request or Publish - id: changesets - uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2 - with: - github-token: ${{ steps.app-token.outputs.token }} - version-script: pnpm release:version - commit-message: '[${{ env.RELEASE_VERSION }}] Publish packages' - pr-title: '[${{ env.RELEASE_VERSION }}] Publish packages' - publish-script: pnpm publish-packages - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + id-token: write + uses: codama-idl/release-tools/.github/workflows/release.yml@v1 + with: + release-version: 1.x + secrets: inherit dependabot: name: Dependabot diff --git a/package.json b/package.json index d61baf2b7..147cb672c 100644 --- a/package.json +++ b/package.json @@ -7,13 +7,13 @@ "lint": "oxlint && oxfmt --check", "lint:fix": "oxlint --fix && oxfmt", "test": "turbo run test --log-order grouped", - "publish-packages": "pnpm build && changeset publish", + "release:publish": "pnpm build && changeset publish", "release:version": "changeset version && release-tools postversion" }, "devDependencies": { "@changesets/changelog-github": "^1.0.1", "@changesets/cli": "^3.0.2", - "@codama/release-tools": "github:codama-idl/release-tools#v1.2.0", + "@codama/release-tools": "github:codama-idl/release-tools#v1.3.1", "@solana-config/oxc": "^0.1.1", "@types/node": "^26", "agadoo": "^3.0.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b155e6feb..b9e0c9ac6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -15,8 +15,8 @@ importers: specifier: ^3.0.2 version: 3.0.2 '@codama/release-tools': - specifier: github:codama-idl/release-tools#v1.2.0 - version: https://codeload.github.com/codama-idl/release-tools/tar.gz/97d4c3bdd1bf5623cdc53a083bf2a00bf24843c5 + specifier: github:codama-idl/release-tools#v1.3.1 + version: https://codeload.github.com/codama-idl/release-tools/tar.gz/1c42099ad47946663c997cb77a0b96db8ebacd96 '@solana-config/oxc': specifier: ^0.1.1 version: 0.1.1(oxfmt@0.67.0)(oxlint@1.82.0(oxlint-tsgolint@7.0.2001)) @@ -488,8 +488,8 @@ packages: resolution: {integrity: sha512-y7/yvZ2TPAnR9+jnc00klvNNLkJiXFFrQA/hlLCcxA9a2A4zQIOimyFQ9XfwYKiGD1fb5GY8vbKIIgO8d5Tb2A==} engines: {node: '>= 20.12.0'} - '@codama/release-tools@https://codeload.github.com/codama-idl/release-tools/tar.gz/97d4c3bdd1bf5623cdc53a083bf2a00bf24843c5': - resolution: {tarball: https://codeload.github.com/codama-idl/release-tools/tar.gz/97d4c3bdd1bf5623cdc53a083bf2a00bf24843c5} + '@codama/release-tools@https://codeload.github.com/codama-idl/release-tools/tar.gz/1c42099ad47946663c997cb77a0b96db8ebacd96': + resolution: {tarball: https://codeload.github.com/codama-idl/release-tools/tar.gz/1c42099ad47946663c997cb77a0b96db8ebacd96} version: 1.0.0 engines: {node: '>=20'} hasBin: true @@ -3385,7 +3385,7 @@ snapshots: fast-wrap-ansi: 0.2.2 sisteransi: 1.0.5 - '@codama/release-tools@https://codeload.github.com/codama-idl/release-tools/tar.gz/97d4c3bdd1bf5623cdc53a083bf2a00bf24843c5': {} + '@codama/release-tools@https://codeload.github.com/codama-idl/release-tools/tar.gz/1c42099ad47946663c997cb77a0b96db8ebacd96': {} '@codama/spec@1.9.2': {}