ci: enable npm trusted publishing with OIDC

[cwandev]

Summary by CodeRabbit

• Release Process
  • Improved automated publishing for versioned releases.
  • Release builds now use a consistent, up-to-date build environment.
  • Packages are staged before publication to support a more reliable release workflow.
  • Release notes are generated automatically when a new version is published.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release pipeline now uses Node.js 24 and pnpm to install, build, stage-publish packages, and generate GitHub release notes. The workflow adds OIDC token permission and removes the separate npm publishing job.

Changes

Release pipeline

Layer / File(s)	Summary
Staged package publishing packages/core/package.json	The pub:release script now runs pnpm stage publish with the existing publish flags.
Consolidated release workflow .github/workflows/release.yaml	The tag-triggered job installs pnpm, uses Node.js 24.x, installs frozen dependencies, builds, publishes through pub:release, and generates release notes with pnpm dlx changelogithub. The workflow also adds id-token: write and removes the separate npm job.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHub Actions
  participant pnpm
  participant Package Registry
  participant GitHub Releases
  GitHub Actions->>pnpm: Install dependencies and build
  GitHub Actions->>pnpm: Run pub:release
  pnpm->>Package Registry: Publish staged packages
  GitHub Actions->>GitHub Releases: Generate release notes

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	No pull request description was provided, so the required sections from the template are missing.	Add the Summary, Linked issue, Type of change, Description, Testing, Screenshots, and Checklist sections from the template.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: enabling OIDC trusted publishing in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/npm-trusted-publishing-oidc

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/release.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

packages/core/package.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yaml:
- Around line 21-22: Pin all privileged release tooling to reviewed immutable
versions: update actions/checkout at .github/workflows/release.yaml lines 16-17,
pnpm/action-setup at lines 21-22, and actions/setup-node at lines 24-28 to
verified full-length commit SHAs; update the changelogithub invocation at lines
40-41 to use an exact reviewed version such as changelogithub@14.0.0 or execute
a locked local dependency via pnpm.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 29cbc663-ac8a-4722-8e57-7e111795465f

📥 Commits

Reviewing files that changed from the base of the PR and between 48ae29a and 80c17aa.

📒 Files selected for processing (2)

• .github/workflows/release.yaml
• packages/core/package.json

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/base-ui-vue@47

commit: 80c17aa