From 5a53b8ba5ca95e969fd3ac5a73eae7a35a806d2a Mon Sep 17 00:00:00 2001 From: MichalKinas Date: Wed, 25 Feb 2026 16:36:31 +0100 Subject: [PATCH] Enable trusted publishing --- .github/actions/publish-libs/action.yml | 12 +++---- .github/actions/publish-libs/npm-publish.sh | 2 ++ .github/workflows/release.yml | 39 ++++++++++++--------- .nvmrc | 2 +- 4 files changed, 30 insertions(+), 25 deletions(-) diff --git a/.github/actions/publish-libs/action.yml b/.github/actions/publish-libs/action.yml index a91cdff0e..55d79ef95 100644 --- a/.github/actions/publish-libs/action.yml +++ b/.github/actions/publish-libs/action.yml @@ -8,9 +8,6 @@ inputs: github_token: description: 'Github token' required: true - npm_registry_token: - description: 'NPM registry token' - required: true npm_tag: description: 'NPM tag' required: true @@ -29,9 +26,11 @@ runs: - name: Build Libraries shell: bash - run: npm ci && npx nx run-many --target=build + run: | + npm ci + npm run ci:build:many - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 name: setup GH registry with: node-version-file: '.nvmrc' @@ -46,7 +45,7 @@ runs: TAG: ${{ inputs.npm_tag }} DRY_RUN: ${{ inputs.dry-run }} - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v6 name: setup NPM registry with: node-version-file: '.nvmrc' @@ -57,6 +56,5 @@ runs: shell: bash run: ${{ github.action_path }}/npm-publish.sh "$TAG" "$DRY_RUN" env: - NODE_AUTH_TOKEN: ${{ inputs.npm_registry_token }} TAG: ${{ inputs.npm_tag }} DRY_RUN: ${{ inputs.dry-run }} diff --git a/.github/actions/publish-libs/npm-publish.sh b/.github/actions/publish-libs/npm-publish.sh index d619a3047..7bd68e565 100755 --- a/.github/actions/publish-libs/npm-publish.sh +++ b/.github/actions/publish-libs/npm-publish.sh @@ -1,5 +1,7 @@ #!/usr/bin/env bash +set -e + ROOT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/../../.." && pwd )" DIST_DIR="$ROOT_DIR/dist/@alfresco" TAG=$1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4334b630d..f351a25c8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,6 +39,10 @@ on: - master - develop +permissions: + id-token: write # Required for OIDC + contents: read + env: BASE_URL: ${{ secrets.PIPELINE_ENV_URL }} ADMIN_EMAIL: ${{ secrets.PIPELINE_ADMIN_USERNAME }} @@ -52,12 +56,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: node - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' cache: 'npm' @@ -78,12 +82,12 @@ jobs: - name: "aca-shared" steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: node - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' cache: 'npm' @@ -102,11 +106,11 @@ jobs: run: exit 1 - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' cache: 'npm' @@ -139,11 +143,11 @@ jobs: run: exit 1 - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' cache: 'npm' @@ -176,18 +180,18 @@ jobs: run: exit 1 - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' cache: 'npm' - uses: ./.github/actions/setup with: npm_tag: ${{ inputs.npm-tag }} - - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v8.24.1 + - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@3768f40c71f5f9b0c4e6a507c8f87ed40d9b60c9 #v12.9.0 with: username: ${{ vars.BOT_GITHUB_USERNAME }} email: ${{ vars.BOT_GITHUB_EMAIL }} @@ -205,6 +209,8 @@ jobs: name: "Publish libs to NPM and GitHub registry" runs-on: ubuntu-latest permissions: + id-token: write # Required for OIDC + contents: read packages: write steps: - name: Check previous jobs status @@ -212,12 +218,12 @@ jobs: run: exit 1 - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 2 - name: Setup node - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' cache: 'npm' @@ -230,8 +236,7 @@ jobs: uses: ./.github/actions/publish-libs with: branch_name: ${{ env.BRANCH_NAME }} - github_token: ${{ secrets.BOT_GITHUB_TOKEN }} - npm_registry_token: ${{ secrets.NPM_REGISTRY_TOKEN }} + github_token: ${{ secrets.GITHUB_TOKEN }} npm_tag: ${{ env.TAG_NPM }} dry-run: ${{ inputs.dry-run-release }} @@ -245,10 +250,10 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Push Source Files to Crowdin - uses: crowdin/github-action@297234bae049541aa48ed268e5de00dee4efa4b4 # v2.8.0 + uses: crowdin/github-action@b4b468cffefb50bdd99dd83e5d2eaeb63c880380 # v2.14.0 with: upload_sources: true upload_sources_args: --delete-obsolete diff --git a/.nvmrc b/.nvmrc index 7d41c735d..9e2934aa3 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -22.14.0 +24.11.1