Skip to content

Migrate release workflows to OIDC auth #6707

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gonzaloriestra merged 1 commit into from
Dec 11, 2025
Merged

Migrate release workflows to OIDC auth #6707

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/actions/setup-cli-deps/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,10 @@ runs:
version: ${{ env.PNPM_VERSION }}
run_install: false
- name: Install Node.js
uses: actions/setup-node@v3
uses: actions/setup-node@v4
with:
node-version: ${{ inputs.node-version }}
registry-url: 'https://registry.npmjs.org'
cache: 'pnpm'
cache-dependency-path: 'pnpm-lock.yaml'
- name: Install dependencies
Expand Down
21 changes: 10 additions & 11 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,10 @@ jobs:
name: Snapit
if: ${{ github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.comment.body == '/snapit' }}
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
id-token: write
steps:
# WARNING: DO NOT RUN ANY CUSTOM LOCAL SCRIPT BEFORE RUNNING THE SNAPIT ACTION
# This action can be executed by 3rd party users and it should not be able to run arbitrary code from a PR.
Expand Down Expand Up @@ -71,7 +75,8 @@ jobs:
build_script: "pnpm nx run-many --target=bundle --all --skip-nx-cache --output-style=stream && pnpm refresh-manifests"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
NPM_TOKEN: ''
NPM_CONFIG_PROVENANCE: true
SHOPIFY_CLI_BUILD_REPO: ${{ github.repository }}

# Changeset release job - runs on push to main or stable branches
Expand All @@ -80,7 +85,7 @@ jobs:
if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.tag == '') }}
runs-on: ubuntu-latest
permissions:
contents: write
contents: read
pull-requests: write
id-token: write
steps:
Expand All @@ -99,7 +104,7 @@ jobs:
title: Version Packages - ${{ github.ref_name }}
publish: pnpm release latest
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
NPM_TOKEN: ''
NPM_CONFIG_PROVENANCE: true
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SHOPIFY_CLI_BUILD_REPO: ${{ github.repository }}
Expand All @@ -110,7 +115,7 @@ jobs:
if: ${{ github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.tag != '') }}
runs-on: ubuntu-latest
permissions:
contents: write
contents: read
pull-requests: write
id-token: write
steps:
Expand All @@ -122,16 +127,10 @@ jobs:
uses: ./.github/actions/setup-cli-deps
with:
node-version: 24.1.0
- name: Creating .npmrc
run: |
cat << EOF > "$HOME/.npmrc"
//registry.npmjs.org/:_authToken=$NPM_TOKEN
EOF
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
- name: Release
run: pnpm release ${{ github.event.inputs.tag || 'nightly' }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ''
NPM_CONFIG_PROVENANCE: true
SHOPIFY_CLI_BUILD_REPO: ${{ github.repository }}