Merged
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR enables OIDC trusted publishing for npm packages by configuring GitHub Actions to use OpenID Connect authentication instead of npm tokens, improving security and eliminating the need for manual token management.
Key changes:
- Added
--provenanceflag to lerna publish command for build attestation - Configured GitHub Actions workflow with required OIDC permissions (
id-token: write) - Removed npm token-based authentication in favor of OIDC
- Added package name comments to all package index files to trigger a full publish for OIDC testing
Reviewed Changes
Copilot reviewed 39 out of 39 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| scripts/performRelease/performLernaRelease.ts | Added --provenance flag to lerna publish command to generate build attestation |
| .github/workflows/push.yml | Added OIDC permissions, removed npm token authentication, fixed typo in comment |
| packages/visx-*/src/index.ts (40 files) | Added package name comments to trigger full publish for testing |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Size Changes
View raw build statsPrevious (master){
"visx-annotation": {
"esm": 19623,
"lib": 23755
},
"visx-axis": {
"esm": 13345,
"lib": 18132
},
"visx-bounds": {
"esm": 1476,
"lib": 1915
},
"visx-brush": {
"esm": 41979,
"lib": 44001
},
"visx-chord": {
"esm": 1886,
"lib": 2683
},
"visx-clip-path": {
"esm": 1488,
"lib": 2713
},
"visx-curve": {
"esm": 336,
"lib": 2594
},
"visx-delaunay": {
"esm": 1448,
"lib": 2489
},
"visx-demo": {
"esm": 0,
"lib": 0
},
"visx-drag": {
"esm": 9039,
"lib": 11025
},
"visx-event": {
"esm": 3533,
"lib": 5257
},
"visx-geo": {
"esm": 8044,
"lib": 11674
},
"visx-glyph": {
"esm": 7177,
"lib": 11421
},
"visx-gradient": {
"esm": 6854,
"lib": 11581
},
"visx-grid": {
"esm": 9578,
"lib": 12892
},
"visx-group": {
"esm": 484,
"lib": 1030
},
"visx-heatmap": {
"esm": 3473,
"lib": 4564
},
"visx-hierarchy": {
"esm": 8620,
"lib": 13458
},
"visx-legend": {
"esm": 14783,
"lib": 20754
},
"visx-marker": {
"esm": 3806,
"lib": 6120
},
"visx-mock-data": {
"esm": 325619,
"lib": 330728
},
"visx-network": {
"esm": 3041,
"lib": 5105
},
"visx-pattern": {
"esm": 7332,
"lib": 10317
},
"visx-point": {
"esm": 761,
"lib": 1901
},
"visx-react-spring": {
"esm": 8675,
"lib": 11009
},
"visx-responsive": {
"esm": 9021,
"lib": 11514
},
"visx-sankey": {
"esm": 2482,
"lib": 3894
},
"visx-scale": {
"esm": 18804,
"lib": 30918
},
"visx-shape": {
"esm": 51794,
"lib": 74614
},
"visx-stats": {
"esm": 9234,
"lib": 10690
},
"visx-text": {
"esm": 5939,
"lib": 7453
},
"visx-threshold": {
"esm": 2045,
"lib": 2758
},
"visx-tooltip": {
"esm": 9156,
"lib": 13672
},
"visx-vendor": {
"esm": 2974,
"lib": 3226
},
"visx-visx": {
"esm": 1524,
"lib": 3999
},
"visx-voronoi": {
"esm": 1281,
"lib": 2088
},
"visx-wordcloud": {
"esm": 1968,
"lib": 2995
},
"visx-xychart": {
"esm": 125096,
"lib": 155595
},
"visx-zoom": {
"esm": 12485,
"lib": 14835
}
}Current{
"visx-annotation": {
"esm": 19643,
"lib": 23755
},
"visx-axis": {
"esm": 13359,
"lib": 18132
},
"visx-bounds": {
"esm": 1493,
"lib": 1915
},
"visx-brush": {
"esm": 41994,
"lib": 44001
},
"visx-chord": {
"esm": 1901,
"lib": 2683
},
"visx-clip-path": {
"esm": 1507,
"lib": 2713
},
"visx-curve": {
"esm": 351,
"lib": 2594
},
"visx-delaunay": {
"esm": 1466,
"lib": 2489
},
"visx-demo": {
"esm": 0,
"lib": 0
},
"visx-drag": {
"esm": 9053,
"lib": 11025
},
"visx-event": {
"esm": 3548,
"lib": 5257
},
"visx-geo": {
"esm": 8057,
"lib": 11674
},
"visx-glyph": {
"esm": 7192,
"lib": 11421
},
"visx-gradient": {
"esm": 6872,
"lib": 11581
},
"visx-grid": {
"esm": 9592,
"lib": 12892
},
"visx-group": {
"esm": 499,
"lib": 1030
},
"visx-heatmap": {
"esm": 3490,
"lib": 4564
},
"visx-hierarchy": {
"esm": 8639,
"lib": 13458
},
"visx-legend": {
"esm": 14799,
"lib": 20754
},
"visx-marker": {
"esm": 3822,
"lib": 6120
},
"visx-mock-data": {
"esm": 325638,
"lib": 330728
},
"visx-network": {
"esm": 3058,
"lib": 5105
},
"visx-pattern": {
"esm": 7349,
"lib": 10317
},
"visx-point": {
"esm": 776,
"lib": 1901
},
"visx-react-spring": {
"esm": 8697,
"lib": 11009
},
"visx-responsive": {
"esm": 9041,
"lib": 11514
},
"visx-sankey": {
"esm": 2498,
"lib": 3894
},
"visx-scale": {
"esm": 18819,
"lib": 30918
},
"visx-shape": {
"esm": 51809,
"lib": 74614
},
"visx-stats": {
"esm": 9249,
"lib": 10690
},
"visx-text": {
"esm": 5953,
"lib": 7453
},
"visx-threshold": {
"esm": 2064,
"lib": 2758
},
"visx-tooltip": {
"esm": 9173,
"lib": 13672
},
"visx-vendor": {
"esm": 2974,
"lib": 3226
},
"visx-visx": {
"esm": 1538,
"lib": 3999
},
"visx-voronoi": {
"esm": 1298,
"lib": 2088
},
"visx-wordcloud": {
"esm": 1987,
"lib": 2995
},
"visx-xychart": {
"esm": 125113,
"lib": 155595
},
"visx-zoom": {
"esm": 12499,
"lib": 14835
}
} |
hshoff
commented
Nov 11, 2025
| // --no-verify-access is needed because the CI token isn't valid for that endpoint | ||
| `npx lerna publish ${version} --exact --yes --dist-tag ${distTag}`, | ||
| // --provenance generates build attestation when using OIDC in GitHub Actions | ||
| `npx lerna publish ${version} --exact --yes --dist-tag ${distTag} --provenance`, |
Member
Author
There was a problem hiding this comment.
--provenance breaks release script and is unnecessary. I missed this detail in the blog post
Fixed in #1972
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🏠 Internal
Related