From 68c95e625e97c14aff99d4f5aa2867bdf169d585 Mon Sep 17 00:00:00 2001 From: Marc Villain Date: Tue, 20 Oct 2026 13:16:35 +0200 Subject: [PATCH] ci: stage releases for 2FA approval instead of publishing them The npm trusted publisher may only stage, so a version goes live once a maintainer approves it with 2FA. Staging needs npm 11.15 or later; Node 24.12 ships 11.6, so the job installs a pinned npm first. --- .github/workflows/publish.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 3316ecc..b19db44 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,8 +1,10 @@ -# Publishes @crudy/pgmorbac to npmjs on version tags (v..) +# Stages @crudy/pgmorbac to npmjs on version tags (v..) # through npm trusted publishing: GitHub's OIDC token stands in for an npm # token, and npm attaches a provenance statement naming this repository and -# commit. The organisation only allows its own actions, so checkout and Node -# setup are plain shell. prepack downloads the signed crudylabs/pgmorbac +# commit. The trusted publisher may only stage: a staged version goes live once +# a maintainer approves it with 2FA (npm stage approve, or npmjs.com). The +# organisation only allows its own actions, so checkout and Node setup are +# plain shell. prepack downloads the signed crudylabs/pgmorbac # release of the same version and verifies it, so that release must exist # before this tag is pushed. name: publish @@ -37,6 +39,8 @@ jobs: tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1 rm "$file" echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH" + - name: Install npm with staged publishing + run: npm install -g npm@11.21.1 - run: npm install --no-audit --no-fund - run: npm test - name: Publish @@ -47,5 +51,5 @@ jobs: if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then echo "$NAME@$VERSION is already published" else - npm publish --access public + npm stage publish fi