From 568e7c35ce5356bca9b4662b076f85cee2f811f4 Mon Sep 17 00:00:00 2001 From: Maarten Zuidhoorn Date: Wed, 3 Jun 2026 17:39:33 +0200 Subject: [PATCH 1/4] Bump `action-npm-publish` to `v6` and enable OIDC publishing --- .github/workflows/main.yml | 1 + .github/workflows/publish-release.yml | 123 ++++++++++++++++++++------ 2 files changed, 99 insertions(+), 25 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 8ed453d..487961e 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -70,6 +70,7 @@ jobs: if: needs.is-release.outputs.IS_RELEASE == 'true' permissions: contents: write + id-token: write uses: ./.github/workflows/publish-release.yml secrets: NPM_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 7e50d7e..a900861 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -4,43 +4,53 @@ on: workflow_call: secrets: NPM_TOKEN: - required: true + required: false SLACK_WEBHOOK_URL: required: true + PUBLISH_DOCS_TOKEN: + required: true -concurrency: - group: publish-release - queue: max +permissions: + contents: read jobs: - publish-release: - permissions: - contents: write + build: + name: Build runs-on: ubuntu-latest steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@v3 with: is-high-risk-environment: true - node-version: 24.x - - name: Publish GitHub release - uses: MetaMask/action-publish-release@v3 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - run: yarn build + ref: ${{ github.sha }} + - name: Build + run: yarn build + - name: Upload build artifacts + uses: actions/upload-artifact@v7 + with: + name: publish-release-artifacts-${{ github.sha }} + retention-days: 4 + include-hidden-files: true + path: | + ./dist + ./node_modules/.yarn-state.yml publish-npm-dry-run: - name: Dry run publish to NPM + name: Publish to NPM (dry run) + needs: build runs-on: ubuntu-latest - needs: publish-release steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@v3 with: is-high-risk-environment: true ref: ${{ github.sha }} - node-version: 24.x - - name: Dry run publish to NPM + - name: Restore build artifacts + uses: actions/download-artifact@v8 + with: + name: publish-release-artifacts-${{ github.sha }} + - name: Dry Run Publish + # omit npm-token token to perform dry run publish uses: MetaMask/action-npm-publish@v5 with: slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }} @@ -48,17 +58,80 @@ jobs: publish-npm: name: Publish to NPM - environment: npm-publish - runs-on: ubuntu-latest needs: publish-npm-dry-run + runs-on: ubuntu-latest + environment: npm-publish + permissions: + contents: read + id-token: write steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@v3 with: is-high-risk-environment: true ref: ${{ github.sha }} - node-version: 24.x - - name: Publish to NPM - uses: MetaMask/action-npm-publish@v5 + - name: Restore build artifacts + uses: actions/download-artifact@v8 with: + name: publish-release-artifacts-${{ github.sha }} + - name: Publish + uses: MetaMask/action-npm-publish@v6 + with: + # This `NPM_TOKEN` needs to be manually set to publish a package for + # the first time only. + # Look in the repository settings under "Environments", and set this + # token in the `npm-publish` environment, and delete it after the + # initial publish. npm-token: ${{ secrets.NPM_TOKEN }} + + get-release-version: + name: Get release version + needs: publish-npm + runs-on: ubuntu-latest + outputs: + RELEASE_VERSION: ${{ steps.get-release-version.outputs.RELEASE_VERSION }} + steps: + - uses: actions/checkout@v6 + with: + ref: ${{ github.sha }} + - id: get-release-version + shell: bash + run: ./scripts/get.sh ".version" "RELEASE_VERSION" + + publish-release-to-gh-pages: + name: Publish docs to `${{ needs.get-release-version.outputs.RELEASE_VERSION }}` directory of `gh-pages` branch + needs: get-release-version + permissions: + contents: write + uses: ./.github/workflows/publish-docs.yml + with: + destination_dir: ${{ needs.get-release-version.outputs.RELEASE_VERSION }} + secrets: + PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }} + + publish-release-to-latest-gh-pages: + name: Publish docs to `latest` directory of `gh-pages` branch + needs: publish-npm + permissions: + contents: write + uses: ./.github/workflows/publish-docs.yml + with: + destination_dir: latest + secrets: + PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }} + + publish-release: + name: Publish to GitHub + needs: publish-npm + permissions: + contents: write + runs-on: ubuntu-latest + steps: + - name: Checkout and setup environment + uses: MetaMask/action-checkout-and-setup@v3 + with: + is-high-risk-environment: true + ref: ${{ github.sha }} + - uses: MetaMask/action-publish-release@v3 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 5ab64ea39586205e7377c20cc8905b85cc5e9c13 Mon Sep 17 00:00:00 2001 From: Maarten Zuidhoorn Date: Wed, 3 Jun 2026 17:40:52 +0200 Subject: [PATCH 2/4] Remove unneeded steps --- .github/workflows/publish-release.yml | 58 --------------------------- 1 file changed, 58 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index a900861..2faf488 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -14,30 +14,8 @@ permissions: contents: read jobs: - build: - name: Build - runs-on: ubuntu-latest - steps: - - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 - with: - is-high-risk-environment: true - ref: ${{ github.sha }} - - name: Build - run: yarn build - - name: Upload build artifacts - uses: actions/upload-artifact@v7 - with: - name: publish-release-artifacts-${{ github.sha }} - retention-days: 4 - include-hidden-files: true - path: | - ./dist - ./node_modules/.yarn-state.yml - publish-npm-dry-run: name: Publish to NPM (dry run) - needs: build runs-on: ubuntu-latest steps: - name: Checkout and setup environment @@ -84,42 +62,6 @@ jobs: # initial publish. npm-token: ${{ secrets.NPM_TOKEN }} - get-release-version: - name: Get release version - needs: publish-npm - runs-on: ubuntu-latest - outputs: - RELEASE_VERSION: ${{ steps.get-release-version.outputs.RELEASE_VERSION }} - steps: - - uses: actions/checkout@v6 - with: - ref: ${{ github.sha }} - - id: get-release-version - shell: bash - run: ./scripts/get.sh ".version" "RELEASE_VERSION" - - publish-release-to-gh-pages: - name: Publish docs to `${{ needs.get-release-version.outputs.RELEASE_VERSION }}` directory of `gh-pages` branch - needs: get-release-version - permissions: - contents: write - uses: ./.github/workflows/publish-docs.yml - with: - destination_dir: ${{ needs.get-release-version.outputs.RELEASE_VERSION }} - secrets: - PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }} - - publish-release-to-latest-gh-pages: - name: Publish docs to `latest` directory of `gh-pages` branch - needs: publish-npm - permissions: - contents: write - uses: ./.github/workflows/publish-docs.yml - with: - destination_dir: latest - secrets: - PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }} - publish-release: name: Publish to GitHub needs: publish-npm From f2053e7261f8c7f10e9a6bdd016442cce635e3ea Mon Sep 17 00:00:00 2001 From: Maarten Zuidhoorn Date: Wed, 3 Jun 2026 17:41:53 +0200 Subject: [PATCH 3/4] Remove obsolete comment --- .github/workflows/publish-release.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 2faf488..1dffc7e 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -28,7 +28,6 @@ jobs: with: name: publish-release-artifacts-${{ github.sha }} - name: Dry Run Publish - # omit npm-token token to perform dry run publish uses: MetaMask/action-npm-publish@v5 with: slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }} From db802cea3f288d08df8bee9613c8be4dfd63005a Mon Sep 17 00:00:00 2001 From: Maarten Zuidhoorn Date: Wed, 3 Jun 2026 17:43:50 +0200 Subject: [PATCH 4/4] Remove unused docs token --- .github/workflows/publish-release.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 1dffc7e..a2030eb 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -7,8 +7,6 @@ on: required: false SLACK_WEBHOOK_URL: required: true - PUBLISH_DOCS_TOKEN: - required: true permissions: contents: read