Skip to content

Commit ecc2911

Browse files
gnbmgnbm
authored
chore(npm): attempt to fix issue with Trusted Publishers when using reusable workflows (#30787)
Issue number: resolves # --------- <!-- Please do not submit updates to dependencies unless it fixes an issue. --> <!-- Please try to limit your pull request to one type (bugfix, feature, etc). Submit multiple pull requests if needed. --> ## What is the current behavior? <!-- Please describe the current behavior that you are modifying. --> - Publishing to npm is failing due to the changes to move to Trusted Publishers, since it seems that they still don't support reusable workflows, as mentioned [here](https://github.com/orgs/community/discussions/174507) - The action to which we grant permissions on npm needs to follow a strict path location `.github/workflows/` in your repository. ## What is the new behavior? <!-- Please describe the behavior or changes that are being added by this PR. --> - Fixed permissions mismatch by applying the orchestrator method for npm publish: release-orchestrator.yml (contents: read, id-token: write) ├─→ nightly.yml (contents: read, id-token: write) │ └─→ release-ionic.yml (contents: read, id-token: write) │ └─→ publish-npm.yml (contents: read, id-token: write) ✅ ├─→ dev-build.yml (contents: read, id-token: write) │ └─→ release-ionic.yml (contents: read, id-token: write) │ └─→ publish-npm.yml (contents: read, id-token: write) ✅ └─→ release.yml (contents: read, id-token: write) └─→ release-ionic.yml (contents: read, id-token: write) └─→ publish-npm.yml (contents: read, id-token: write) ✅ - `release-orchestrator.yml` calls three workflows: `nightly.yml`, `dev-build.yml`, and `release.yml`. - All three call `release-ionic.yml`, which handles publishing multiple packages. - `release-ionic.yml` calls `publish-npm.yml` multiple times (once per package). - All workflows have `contents: read` and `id-token: write` permissions. - `publish-npm.yml` is in `.github/workflows/`, which satisfies npm Trusted Publishers requirements. - This shows that `publish-npm.yml` is reachable through all three release paths, and moving it to `.github/workflows/` ensures npm Trusted Publishers can authenticate it correctly. ## Does this introduce a breaking change? - [ ] Yes - [x] No <!-- If this introduces a breaking change: 1. Describe the impact and migration path for existing applications below. 2. Update the BREAKING.md file with the breaking change. 3. Add "BREAKING CHANGE: [...]" to the commit description when merging. See https://github.com/ionic-team/ionic-framework/blob/main/docs/CONTRIBUTING.md#footer for more information. --> - Run pipelines after merge ## Other information <!-- Any other information that is important to this PR such as screenshots of how the component looks before and after the change. --> - The workflow `release-orchestrator.yml` needs to be the one set up in the npm package settings for the Trusted Publishers
1 parent 92db364 commit ecc2911

File tree

6 files changed

+130
-8
lines changed

6 files changed

+130
-8
lines changed

‎.github/workflows/dev-build.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@ name: 'Ionic Dev Build'
22

33
on:
44
workflow_dispatch:
5+
workflow_call:
6+
7+
permissions:
8+
contents: read
9+
id-token: write
510

611
jobs:
712
create-dev-hash:

‎.github/workflows/nightly.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@ on:
55
# Run every Monday-Friday
66
# at 6:00 UTC (6:00 am UTC)
77
- cron: '00 06 * * 1-5'
8+
workflow_call:
9+
10+
permissions:
11+
contents: read
12+
id-token: write
813

914
jobs:
1015
create-nightly-hash:

‎.github/workflows/actions/publish-npm/action.yml‎ renamed to ‎.github/workflows/publish-npm.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ runs:
2626
with:
2727
node-version: ${{ inputs.node-version }}
2828
registry-url: 'https://registry.npmjs.org'
29+
scope: '@ionic'
2930
# Provenance requires npm 9.5.0+
3031
- name: 📦 Install latest npm
3132
run: npm install -g npm@latest

‎.github/workflows/release-ionic.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
runs-on: ubuntu-latest
2525
steps:
2626
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
27-
- uses: ./.github/workflows/actions/publish-npm
27+
- uses: ./.github/workflows/publish-npm.yml
2828
with:
2929
scope: '@ionic/core'
3030
tag: ${{ inputs.tag }}
@@ -55,7 +55,7 @@ jobs:
5555
name: ionic-docs
5656
path: ./packages/docs
5757
filename: DocsBuild.zip
58-
- uses: ./.github/workflows/actions/publish-npm
58+
- uses: ./.github/workflows/publish-npm.yml
5959
with:
6060
scope: '@ionic/docs'
6161
tag: ${{ inputs.tag }}
@@ -74,7 +74,7 @@ jobs:
7474
name: ionic-core
7575
path: ./core
7676
filename: CoreBuild.zip
77-
- uses: ./.github/workflows/actions/publish-npm
77+
- uses: ./.github/workflows/publish-npm.yml
7878
with:
7979
scope: '@ionic/angular'
8080
tag: ${{ inputs.tag }}
@@ -100,7 +100,7 @@ jobs:
100100
name: ionic-core
101101
path: ./core
102102
filename: CoreBuild.zip
103-
- uses: ./.github/workflows/actions/publish-npm
103+
- uses: ./.github/workflows/publish-npm.yml
104104
with:
105105
scope: '@ionic/react'
106106
tag: ${{ inputs.tag }}
@@ -125,7 +125,7 @@ jobs:
125125
name: ionic-core
126126
path: ./core
127127
filename: CoreBuild.zip
128-
- uses: ./.github/workflows/actions/publish-npm
128+
- uses: ./.github/workflows/publish-npm.yml
129129
with:
130130
scope: '@ionic/vue'
131131
tag: ${{ inputs.tag }}
@@ -150,7 +150,7 @@ jobs:
150150
name: ionic-core
151151
path: ./core
152152
filename: CoreBuild.zip
153-
- uses: ./.github/workflows/actions/publish-npm
153+
- uses: ./.github/workflows/publish-npm.yml
154154
with:
155155
scope: '@ionic/angular-server'
156156
tag: ${{ inputs.tag }}
@@ -176,7 +176,7 @@ jobs:
176176
name: ionic-react
177177
path: ./packages/react
178178
filename: ReactBuild.zip
179-
- uses: ./.github/workflows/actions/publish-npm
179+
- uses: ./.github/workflows/publish-npm.yml
180180
with:
181181
scope: '@ionic/react-router'
182182
tag: ${{ inputs.tag }}
@@ -201,7 +201,7 @@ jobs:
201201
name: ionic-vue
202202
path: ./packages/vue
203203
filename: VueBuild.zip
204-
- uses: ./.github/workflows/actions/publish-npm
204+
- uses: ./.github/workflows/publish-npm.yml
205205
with:
206206
scope: '@ionic/vue-router'
207207
tag: ${{ inputs.tag }}

‎.github/workflows/release-orchestrator.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: 'Ionic Release'
2+
3+
on:
4+
schedule:
5+
# Run every Monday-Friday
6+
# at 6:00 UTC (6:00 am UTC)
7+
- cron: '00 06 * * 1-5'
8+
workflow_dispatch:
9+
inputs:
10+
release-type:
11+
description: 'Which Ionic release workflow should run?'
12+
required: true
13+
type: choice
14+
default: nightly
15+
options:
16+
- dev
17+
- nightly
18+
- production
19+
version:
20+
description: 'Which version should be published? (Only for production releases)'
21+
required: false
22+
type: choice
23+
options:
24+
- patch
25+
- minor
26+
- major
27+
- prepatch
28+
- preminor
29+
- premajor
30+
- prerelease
31+
tag:
32+
description: 'Which npm tag should this be published to? (Only for production releases)'
33+
required: false
34+
type: choice
35+
default: latest
36+
options:
37+
- latest
38+
- next
39+
preid:
40+
description: 'Which prerelease identifier should be used? (Only for production releases)'
41+
required: false
42+
type: choice
43+
default: ''
44+
options:
45+
- ''
46+
- alpha
47+
- beta
48+
- rc
49+
- next
50+
51+
permissions:
52+
contents: read
53+
id-token: write
54+
55+
jobs:
56+
run-nightly:
57+
if: ${{ github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.release-type == 'nightly') }}
58+
uses: ./.github/workflows/nightly.yml
59+
secrets: inherit
60+
61+
run-dev:
62+
if: ${{ github.event_name == 'workflow_dispatch' && inputs.release-type == 'dev' }}
63+
uses: ./.github/workflows/dev-build.yml
64+
secrets: inherit
65+
66+
run-production:
67+
if: ${{ github.event_name == 'workflow_dispatch' && inputs.release-type == 'production' }}
68+
uses: ./.github/workflows/release.yml
69+
secrets: inherit
70+
with:
71+
version: ${{ inputs.version }}
72+
tag: ${{ inputs.tag }}
73+
preid: ${{ inputs.preid }}

‎.github/workflows/release.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,47 @@ on:
3232
- beta
3333
- rc
3434
- next
35+
workflow_call:
36+
inputs:
37+
version:
38+
description: 'Which version should be published?'
39+
required: true
40+
type: string
41+
tag:
42+
description: 'Which npm tag should this be published to?'
43+
required: true
44+
type: string
45+
preid:
46+
description: 'Which prerelease identifier should be used? This is only needed when version is "prepatch", "preminor", "premajor", or "prerelease".'
47+
required: false
48+
type: string
49+
50+
permissions:
51+
contents: read
52+
id-token: write
3553

3654
jobs:
55+
validate_version:
56+
name: ✅ Validate Version Input
57+
runs-on: ubuntu-latest
58+
steps:
59+
- name: 🔎 Ensure version is allowed
60+
env:
61+
VERSION: ${{ inputs.version }}
62+
run: |
63+
case "$VERSION" in
64+
patch|minor|major|prepatch|preminor|premajor|prerelease)
65+
exit 0
66+
;;
67+
*)
68+
echo "::error::Invalid version input: '$VERSION'. Allowed values: patch, minor, major, prepatch, preminor, premajor, prerelease."
69+
exit 1
70+
;;
71+
esac
72+
shell: bash
73+
3774
release-ionic:
75+
needs: [validate_version]
3876
permissions:
3977
contents: read
4078
id-token: write

0 commit comments

Comments
 (0)