Skip to content

chore(ci): use npm trusted publishing#315

Merged
ewanharris merged 2 commits into
mainfrom
chore/trusted-publishing
Feb 10, 2026
Merged

chore(ci): use npm trusted publishing#315
ewanharris merged 2 commits into
mainfrom
chore/trusted-publishing

Conversation

@rhamzeh

@rhamzeh rhamzeh commented Feb 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Description

Setup NPM Trusted Publishing

NPM also has been setup
Screenshot 2026-02-09 at 3 33 04 PM

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

  • I have clicked on "allow edits by maintainers".
  • I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
  • The correct base branch is being used, if not main
  • I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

  • Chores
    • Updated continuous integration workflow configuration.

@rhamzeh
rhamzeh requested a review from a team as a code owner February 9, 2026 20:30
Copilot AI review requested due to automatic review settings February 9, 2026 20:30
@dosubot

dosubot Bot commented Feb 9, 2026

Copy link
Copy Markdown

Related Documentation

Checked 7 published document(s) in 1 knowledge base(s). No updates required.

How did I do? Any feedback?  Join Discord

@coderabbitai

coderabbitai Bot commented Feb 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

Removed the NODE_AUTH_TOKEN environment variable assignment from the "Publish to npm" workflow step, eliminating the NPM token configuration from that step's environment.

Changes

Cohort / File(s) Summary
NPM publish workflow configuration
.github/workflows/main.yaml		 Removed NODE_AUTH_TOKEN environment variable assignment from the "Publish to npm" step.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main change: removing NODE_AUTH_TOKEN environment variable assignment to adopt npm trusted publishing instead of token-based authentication.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch chore/trusted-publishing

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov-commenter

codecov-commenter commented Feb 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.55%. Comparing base (35b9c92) to head (d8c0ad6).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #315   +/-   ##
=======================================
  Coverage   89.55%   89.55%           
=======================================
  Files          25       25           
  Lines        1475     1475           
  Branches      254      254           
=======================================
  Hits         1321     1321           
  Misses         93       93           
  Partials       61       61

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot AI reviewed Feb 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the npm publish workflow to rely on npm Trusted Publishing (OIDC) instead of a long-lived NPM_TOKEN, aligning the release pipeline with modern, short-lived credential publishing.

Changes:

  • Removed NODE_AUTH_TOKEN usage from the npm publish step.
  • Leaves the workflow configured to publish on version tags with id-token: write permissions (required for OIDC-based publishing).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

SoulPancake
SoulPancake previously approved these changes Feb 10, 2026
View reviewed changes
@SoulPancake
SoulPancake added this pull request to the merge queue Feb 10, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Feb 10, 2026
@SoulPancake
SoulPancake requested a review from a team February 10, 2026 05:40
@ewanharris
ewanharris added this pull request to the merge queue Feb 10, 2026
Merged via the queue into main with commit 528d606 Feb 10, 2026
20 checks passed
@ewanharris
ewanharris deleted the chore/trusted-publishing branch February 10, 2026 11:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@ewanharris ewanharris ewanharris approved these changes
@SoulPancake SoulPancake SoulPancake left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@rhamzeh @codecov-commenter @ewanharris @SoulPancake