fix(ci): harden release workflows — Node 24, permissions, registry-url - #2720
fix(ci): harden release workflows — Node 24, permissions, registry-url#2720cs-raj wants to merge 2 commits into
Conversation
- Add `permissions: contents: read / id-token: write` to both release jobs; id-token:write is required for npm provenance (SLSA attestation) - Upgrade node-version from 22.x to 24 to match the org-wide publish standard and stay ahead of Node 22 LTS EOL - Add `registry-url: https://registry.npmjs.org/` to setup-node so the runner writes a proper .npmrc with NODE_AUTH_TOKEN wired up for any plain `npm` calls in the job Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
- Add 'Update npm' step (npm install -g npm@latest) before publish in both release jobs — ensures npm supports --provenance (requires npm 9+) - Add provenance: true to all JS-DevTools/npm-publish@v3 steps so the OIDC token granted by id-token:write is actually used to generate SLSA attestations on npmjs.com Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
1 participant
Summary
Aligns the CLI production release workflows with the org-wide publish standard.
permissions: id-token: writeadded to bothrelease-production-core.ymlandrelease-production-platform-plugins.yml— required for npm provenance (SLSA attestations). Without this the OIDC token is never issued and provenance silently fails.permissions: contents: readmade explicit (was implicitly set by the default, now declared to be consistent and least-privilege).registry-url: https://registry.npmjs.org/added to thesetup-nodestep — causes the runner to write a.npmrcwithNODE_AUTH_TOKENcorrectly wired up, which is needed if any future step uses plainnpm publishinstead of the JS-DevTools action.Files changed
.github/workflows/release-production-core.ymlpermissionsblock, bump Node, addregistry-url.github/workflows/release-production-platform-plugins.ymlTest plan
mainand confirm both jobs complete without permission errors🤖 Generated with Claude Code