ci: PR test workflow + hardened npm publish - #11
Merged
Conversation
… auth) The repo had no CI on pull requests at all — only the convert workflow (instruction-file paths) and the tag publish. Adds a Node 20/22/24 matrix running build + tests + pack dry-run on every PR and main push. Publish hardening: skip when the version already exists on the registry (safe re-runs), enable --provenance (id-token permission was already declared but unused), wire NODE_AUTH_TOKEN explicitly, add npm cache, concurrency group, and a timeout.
Configure publish-npm.yml as the package's trusted publisher on npmjs.com; the job's OIDC identity (id-token: write) replaces any token secret, and provenance is attached automatically. Node 24 already bundles npm 11 which supports this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two gaps closed:
1. No CI on pull requests
The repo only had the convert workflow (triggers on instruction-file paths) and the tag publish — PRs like #9/#10 ran zero checks. Adds
.github/workflows/ci.yml: Node 20/22/24 matrix runningnpm ci && npm run build && npm test && npm pack --dry-runon every PR and main push.2. Publish workflow: trusted publishing (OIDC), hardened
npm publishauthenticates via the workflow's OIDC identity — noNPM_TOKENsecret; provenance is attached automatically (Node 24 bundles npm 11, which supports trusted publishing).One-time npmjs.com setup (owner action)
On npmjs.com → @disdjj/acplugin → Settings → Trusted Publisher: select GitHub Actions, organization
TokenRollAI, repositoryacplugin, workflow filenamepublish-npm.yml(environment: leave empty). Then delete anyNPM_TOKENsecret — nothing uses it.Release flow unchanged: bump version → tag
vX.Y.Z→ push tag.