chore: use npm Trusted Publishers and unify release workflow #3501
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Migrate from NPM_TOKEN to OIDC-based Trusted Publishers. Merge release and prerelease into a single workflow (npm only allows one workflow per trusted publisher). Remove obsolete prerelease-tolgee-5 workflow.
|
Caution Review failedThe pull request is closed. WalkthroughThe PR consolidates two separate prerelease workflow files (prerelease-tolgee-5.yml and prerelease.yml) into the main release.yml workflow. The unified workflow now handles both release and prerelease flows through conditional steps triggered by different event types and git tags. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
JanCizmar
added a commit
that referenced
this pull request
Feb 10, 2026
## Summary npm classic tokens have been deprecated and capped to 90-day expiry. The NPM_TOKEN used for publishing has expired, breaking the release pipeline. This migrates to OIDC-based Trusted Publishers and consolidates the release workflows: - Add `permissions` block for OIDC (`id-token: write`) - Add `registry-url` to `setup-node` so npm auth is handled automatically - Remove manual `.npmrc` creation and `NPM_TOKEN` usage - Merge `prerelease.yml` into `release.yml` (npm only allows one workflow per trusted publisher config) - Delete obsolete `prerelease-tolgee-5.yml` **Requires configuring Trusted Publishers on npmjs.com for each `@tolgee/*` package.** ## Test plan - [ ] Configure Trusted Publishers on npmjs.com for all @tolgee packages - [ ] Verify release pipeline publishes successfully on next merge to main - [ ] Verify prerelease pipeline works when pushing a `prerelease` tag
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
npm classic tokens have been deprecated and capped to 90-day expiry. The NPM_TOKEN used for publishing has expired, breaking the release pipeline.
This migrates to OIDC-based Trusted Publishers and consolidates the release workflows:
permissionsblock for OIDC (id-token: write)registry-urltosetup-nodeso npm auth is handled automatically.npmrccreation andNPM_TOKENusageprerelease.ymlintorelease.yml(npm only allows one workflow per trusted publisher config)prerelease-tolgee-5.ymlRequires configuring Trusted Publishers on npmjs.com for each
@tolgee/*package.Test plan
prereleasetagSummary by CodeRabbit