Skip to content

Switch to NPM OIDC publishing #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stwiname merged 4 commits into from
Dec 1, 2025
Merged

Switch to NPM OIDC publishing #60

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f267a45
Switch to NPM OIDC publishing
stwiname Dec 1, 2025
915ac13
Update PR workflow
stwiname Dec 1, 2025
a76e97b
Fix husky
stwiname Dec 1, 2025
e9b3773
fix filter condition
stwiname Dec 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 1 addition & 6 deletions .github/actions/create-prerelease/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,19 +7,14 @@ inputs:
package-path:
description: 'package path to run action e.g. package/common'
required: true
npm-token:
description: 'token to push to npm registry'
required: true

runs:
using: "composite"
using: 'composite'
steps:
- working-directory: ${{ github.workspace }}
run: node ${{ github.action_path }}/remove-stable-version.js ${{ github.workspace }}/${{ inputs.package-path }}
shell: bash

- working-directory: ${{ inputs.package-path }}
run: echo "Changes exist in ${{ inputs.package-path }}" && yarn version prerelease && yarn npm publish --access public --tag dev
env:
NPM_TOKEN: ${{ inputs.npm-token }}
shell: bash
7 changes: 1 addition & 6 deletions .github/actions/create-release/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,17 +9,12 @@ inputs:
repo-token:
description: 'token to create github release'
required: true
npm-token:
description: 'token to push to npm registry'
required: true

runs:
using: "composite"
using: 'composite'
steps:
- working-directory: ${{ inputs.package-path }}
run: echo "Changes exist in ${{ inputs.package-path }}" && yarn npm publish --access public
env:
NPM_TOKEN: ${{ inputs.npm-token }}
shell: bash

- working-directory: ${{ github.workspace }}
Expand Down
25 changes: 12 additions & 13 deletions .github/workflows/pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,19 +9,18 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v2
- name: Setup Node.js environment
uses: actions/setup-node@v2
with:
node-version: 16
- run: yarn
- uses: actions/checkout@v5
- name: Setup Node.js environment
uses: actions/setup-node@v5
with:
node-version: 22
- run: yarn

- name: build
run: yarn build
- name: build
run: yarn build

- name: lint
run: yarn lint

- name: test
run: yarn test --forceExit
- name: lint
run: yarn lint

- name: test
run: yarn test --forceExit
109 changes: 0 additions & 109 deletions .github/workflows/prerelease.yml
View file
Open in desktop

This file was deleted.

210 changes: 210 additions & 0 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,210 @@
name: 'Publish'
on:
push:
branches:
- main
paths-ignore:
- '.github/workflows/**'

permissions:
id-token: write # Required for OIDC
contents: read

concurrency:
group: publish
cancel-in-progress: false

jobs:
pre-ci:
name: Pre-CI (Extract Commit Message)
runs-on: ubuntu-latest
timeout-minutes: 1
outputs:
commit-message: ${{ steps.get_commit_message.outputs.commit-message }}
steps:
- uses: actions/checkout@v5
with:
fetch-depth: 0

- id: get_commit_message
run: |

@coderabbitai coderabbitai Bot Dec 1, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Unsafe use of untrusted context variable in inline script.

Line 30 directly uses github.event.head_commit.message in a shell script, which is untrusted user input and can lead to script injection attacks. Pass it through an environment variable instead:

      - id: get_commit_message
        run: |
+         commit_msg_raw="${{ github.event.head_commit.message }}"
-         if [ -n "${{ github.event.head_commit.message }}" ]
+         if [ -n "$commit_msg_raw" ]
          then
-           commit_msg="${{ github.event.head_commit.message }}"
+           commit_msg="$commit_msg_raw"
            echo "commit-message=${commit_msg}" | head -n 1 >> "$GITHUB_OUTPUT"
          else
            commit_message=$(git log -1 --pretty=%B | head -n 1)
            echo "commit-message=$commit_message" >> "$GITHUB_OUTPUT"
          fi

Also, the release job's condition on line 89–92 references github.event.head_commit.message directly instead of using the pre-ci output. Update it to: startsWith(needs.pre-ci.outputs.commit-message, '[release]') for consistency and safety.

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 actionlint (1.7.9)

30-30: "github.event.head_commit.message" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details

(expression)

🤖 Prompt for AI Agents 
.github/workflows/publish.yml around lines 30 and 89-92: the workflow directly
injects github.event.head_commit.message into an inline shell script (line 30)
and later uses it in the release job condition (lines 89–92), which is unsafe.
Fix by exporting github.event.head_commit.message into an environment variable
(or set it as a pre-ci job output) and reference that env var inside the run
block instead of embedding the raw value; additionally update the release job
condition to use the pre-ci output:
startsWith(needs.pre-ci.outputs.commit-message, '[release]') so all uses read
from the safe, sanitized variable/output rather than
github.event.head_commit.message directly.

if [ -n "${{ github.event.head_commit.message }}" ]
then
commit_msg="${{ github.event.head_commit.message }}"
echo "commit-message=${commit_msg}" | head -n 1 >> "$GITHUB_OUTPUT"
else
commit_message=$(git log -1 --pretty=%B | head -n 1)
echo "commit-message=$commit_message" >> "$GITHUB_OUTPUT"
fi
Comment on lines +30 to +38

@coderabbitai coderabbitai Bot Dec 1, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Script injection vulnerability in pre-ci commit message extraction.

Line 30 uses github.event.head_commit.message directly in an inline script, which is flagged by actionlint as a script injection risk. Pass the value through an environment variable instead.

Apply this diff to secure the script:

      - id: get_commit_message
+        env:
+          COMMIT_MSG_EVENT: ${{ github.event.head_commit.message }}
         run: |
-          if [ -n "${{ github.event.head_commit.message }}" ]
+          if [ -n "$COMMIT_MSG_EVENT" ]
           then
-            commit_msg="${{ github.event.head_commit.message }}"
+            commit_msg="$COMMIT_MSG_EVENT"
             echo "commit-message=${commit_msg}" | head -n 1 >> "$GITHUB_OUTPUT"
           else
             commit_message=$(git log -1 --pretty=%B | head -n 1)
             echo "commit-message=$commit_message" >> "$GITHUB_OUTPUT"
           fi

See: https://docs.github.com/en/actions/security-hardening-your-workflows/security-hardening-for-github-actions

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 actionlint (1.7.9)

30-30: "github.event.head_commit.message" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details

(expression)

🤖 Prompt for AI Agents 
.github/workflows/publish.yml lines 30-38: the inline script uses
github.event.head_commit.message directly which actionlint flags as a
script-injection risk; instead, add an environment variable (e.g., COMMIT_MSG)
for the value at the step level using the expression ${{
github.event.head_commit.message }} and then read that safe env var inside the
shell block (falling back to git log when the env var is empty). Ensure the
script checks the env var (not the event expression), assigns it to a local
variable if present, and writes that sanitized value to GITHUB_OUTPUT so no
untrusted expansion occurs in the inline script.


- name: Debug commit message
run: |
echo "Commit message: ${{ steps.get_commit_message.outputs.commit-message }}"

setup:
name: Setup & Detect Changes
needs: pre-ci
runs-on: ubuntu-latest
outputs:
changed-acala-evm: ${{ steps.changed-acala-evm.outputs.changed }}
changed-frontier-evm: ${{ steps.changed-frontier-evm.outputs.changed }}
changed-moonbeam-evm: ${{ steps.changed-moonbeam-evm.outputs.changed }}
changed-ethermint-evm: ${{ steps.changed-ethermint-evm.outputs.changed }}
changed-substrate-wasm: ${{ steps.changed-substrate-wasm.outputs.changed }}
steps:
- uses: actions/checkout@v5
with:
fetch-depth: 100 # Needed to detect changes by having commit history

- uses: marceloprado/has-changed-path@v1
id: changed-acala-evm
with:
paths: packages/acala-evm

- uses: marceloprado/has-changed-path@v1
id: changed-frontier-evm
with:
paths: packages/frontier-evm

- uses: marceloprado/has-changed-path@v1
id: changed-moonbeam-evm
with:
paths: packages/moonbeam-evm

- uses: marceloprado/has-changed-path@v1
id: changed-ethermint-evm
with:
paths: packages/ethermint-evm
- run: yarn

- uses: marceloprado/has-changed-path@v1
id: changed-substrate-wasm
with:
paths: packages/substrate-wasm
- run: yarn

release:
name: Release Publish
needs: [pre-ci, setup]
if: >
!startsWith(github.event.head_commit.message, '[SKIP CI]')
&& startsWith(github.event.head_commit.message, '[release]')
&& github.repository == 'subquery/datasource-processors'
Comment on lines +86 to +92

@coderabbitai coderabbitai Bot Dec 1, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Inconsistent condition logic between release and prerelease jobs.

The release job's condition (lines 89–92) directly checks github.event.head_commit.message, while the prerelease job (lines 152–154) uses needs.pre-ci.outputs.commit-message. Use the pre-ci output consistently to match the commit message extraction logic and improve safety:

  release:
    name: Release Publish
    needs: [pre-ci, setup]
    if: >
      !startsWith(github.event.head_commit.message, '[SKIP CI]')
-     && startsWith(github.event.head_commit.message, '[release]')
+     && startsWith(needs.pre-ci.outputs.commit-message, '[release]')
      && github.repository == 'subquery/datasource-processors'
🤖 Prompt for AI Agents 
.github/workflows/publish.yml around lines 86 to 92: the release job condition
currently reads against github.event.head_commit.message while the prerelease
job uses needs.pre-ci.outputs.commit-message; change the release job to use
needs.pre-ci.outputs.commit-message instead so both jobs use the same pre-ci
extracted commit message, e.g. replace any
startsWith(github.event.head_commit.message, ...) checks with
startsWith(needs.pre-ci.outputs.commit-message, ...) and keep the existing
!startsWith(..., '[SKIP CI]') and startsWith(..., '[release]') and repository
equality check intact.

runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
with:
fetch-depth: 0

- name: Setup Node.js environment
uses: actions/setup-node@v5
with:
node-version: lts/*

- name: Update npm
run: npm install -g npm@latest

- run: yarn

- name: build
run: yarn build

# Publish to npm and github releases
- name: Publish acala-evm
if: needs.setup.outputs.changed-acala-evm == 'true'
uses: ./.github/actions/create-release
with:
package-path: packages/acala-evm
repo-token: ${{ secrets.REPO_TOKEN }}

- name: Publish frontier-evm
if: needs.setup.outputs.changed-frontier-evm == 'true'
uses: ./.github/actions/create-release
with:
package-path: packages/frontier-evm
repo-token: ${{ secrets.REPO_TOKEN }}

- name: Publish moonbeam-evm
if: needs.setup.outputs.changed-moonbeam-evm == 'true' || needs.setup.outputs.changed-frontier-evm == 'true'
uses: ./.github/actions/create-release
with:
package-path: packages/moonbeam-evm
repo-token: ${{ secrets.REPO_TOKEN }}

- name: Publish ethermint-evm
if: needs.setup.outputs.changed-ethermint-evm == 'true'
uses: ./.github/actions/create-release
with:
package-path: packages/ethermint-evm
repo-token: ${{ secrets.REPO_TOKEN }}

- name: Publish substrate-wasm
if: needs.setup.outputs.changed-substrate-wasm == 'true'
uses: ./.github/actions/create-release
with:
package-path: packages/substrate-wasm
repo-token: ${{ secrets.REPO_TOKEN }}

prerelease:
name: Prerelease Publish
needs: [pre-ci, setup]
if: >
!startsWith(needs.pre-ci.outputs.commit-message, '[SKIP CI]')
&& !startsWith(needs.pre-ci.outputs.commit-message, '[release]')
&& github.repository == 'subquery/datasource-processors'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
with:
fetch-depth: 0
token: ${{ secrets.REPO_TOKEN }} # Needed to push changes back to repo

- name: Setup Node.js environment
uses: actions/setup-node@v5
with:
node-version: lts/*

- name: Update npm
run: npm install -g npm@latest

- run: yarn

- name: build
run: yarn build

# Prerelease publish steps
- name: Bump acala-evm & deploy
if: needs.setup.outputs.changed-acala-evm == 'true'
uses: ./.github/actions/create-prerelease
with:
package-path: packages/acala-evm

- name: Bump frontier-evm & deploy
if: needs.setup.outputs.changed-frontier-evm == 'true'
uses: ./.github/actions/create-prerelease
with:
package-path: packages/frontier-evm

- name: Bump moonbeam-evm & deploy
if: needs.setup.outputs.changed-moonbeam-evm == 'true' || needs.setup.outputs.changed-frontier-evm == 'true'
uses: ./.github/actions/create-prerelease
with:
package-path: packages/moonbeam-evm

- name: Bump ethermint-evm & deploy
if: needs.setup.outputs.changed-ethermint-evm == 'true'
uses: ./.github/actions/create-prerelease
with:
package-path: packages/ethermint-evm

- name: Bump substrate-wasm & deploy
if: needs.setup.outputs.changed-substrate-wasm == 'true'
uses: ./.github/actions/create-prerelease
with:
package-path: packages/substrate-wasm

- name: Commit changes
uses: EndBug/add-and-commit@v9
with:
message: '[SKIP CI] Prerelease'
default_author: github_actions
Loading
Loading