chore(npm): attempt to fix issue with Trusted Publishers when using reusable workflows

[gnbm]

Issue number: resolves #

---

What is the current behavior?

• Publishing to npm is failing due to the changes to move to Trusted Publishers, since it seems that they still don't support reusable workflows, as mentioned here
• The action to which we grant permissions on npm needs to follow a strict path location .github/workflows/ in your repository.

What is the new behavior?

• Fixed permissions mismatch by applying the orchestrator method for npm publish:
  release-orchestrator.yml (contents: read, id-token: write)

  ├─→ nightly.yml (contents: read, id-token: write)
  │ └─→ release-ionic.yml (contents: read, id-token: write)
  │ └─→ publish-npm.yml (contents: read, id-token: write) ✅

  ├─→ dev-build.yml (contents: read, id-token: write)
  │ └─→ release-ionic.yml (contents: read, id-token: write)
  │ └─→ publish-npm.yml (contents: read, id-token: write) ✅

  └─→ release.yml (contents: read, id-token: write)
  └─→ release-ionic.yml (contents: read, id-token: write)
  └─→ publish-npm.yml (contents: read, id-token: write) ✅

• release-orchestrator.yml calls three workflows: nightly.yml, dev-build.yml, and release.yml.

• All three call release-ionic.yml, which handles publishing multiple packages.

• release-ionic.yml calls publish-npm.yml multiple times (once per package).

• All workflows have contents: read and id-token: write permissions.

• publish-npm.yml is in .github/workflows/, which satisfies npm Trusted Publishers requirements.

• This shows that publish-npm.yml is reachable through all three release paths, and moving it to .github/workflows/ ensures npm Trusted Publishers can authenticate it correctly.

Does this introduce a breaking change?

• Yes
• No

• Run pipelines after merge

Other information

• The workflow release-orchestrator.yml needs to be the one set up in the npm package settings for the Trusted Publishers

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
ionic-framework	Ready	Preview	Comment	Nov 17, 2025 5:05pm