From 28f4a91f141181fa176758462b5cc7927f09a0ad Mon Sep 17 00:00:00 2001 From: Nicklas Steffens Date: Fri, 5 Dec 2025 14:36:29 -0500 Subject: [PATCH 1/8] ci: migrate to NPM OIDC trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Replace NPM_TOKEN secret with OIDC authentication - Add id-token: write permission for OIDC - Add setup-node with registry-url for npm provenance - Upgrade npm to 11.x for OIDC support - Add --ci flag to release-it commands - Add npm.skipChecks since no token to validate - Consolidate release types into single workflow with dropdown Closes sc-173900 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .github/workflows/release-it.yml | 51 +++++++++++++++++++++----------- .release-it.json | 3 ++ 2 files changed, 37 insertions(+), 17 deletions(-) diff --git a/.github/workflows/release-it.yml b/.github/workflows/release-it.yml index 65a77ed..ea17251 100644 --- a/.github/workflows/release-it.yml +++ b/.github/workflows/release-it.yml @@ -1,21 +1,28 @@ name: Release on: - push: - branches: - - main - paths: - - 'addon/**/*.js' - - 'addon/**/*.hbs' - - 'addon-test-support/*' - - 'app/**/*.scss' - - 'public/*' workflow_dispatch: inputs: + release_type: + description: 'Release type' + required: true + type: choice + options: + - release + - prerelease + default: release increment: - description: Override Default Version Increment + description: 'Override Default Version Increment (optional)' required: false default: '' + dist_tag: + description: 'Pre-release dist tag (only used for prerelease)' + required: false + default: 'alpha' + +permissions: + contents: write + id-token: write jobs: release: @@ -24,7 +31,15 @@ jobs: - uses: actions/checkout@v4 with: fetch-depth: 0 # Necessary to generate changelog from commit history - - uses: volta-cli/action@v4 + + - name: Setup Node with NPM registry + uses: actions/setup-node@v4 + with: + node-version: '20' + registry-url: 'https://registry.npmjs.org' + + - name: Upgrade npm for OIDC support + run: npm install -g npm@latest - name: git config run: | @@ -34,6 +49,7 @@ jobs: - name: Get yarn cache directory path id: yarn-cache-dir-path run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT + - uses: actions/cache@v4 with: path: ${{ steps.yarn-cache-dir-path.outputs.dir }} @@ -43,11 +59,12 @@ jobs: - run: yarn install --immutable - - name: Configure NPM with auth token - run: npm config set //registry.npmjs.org/:_authToken $NPM_TOKEN - env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - - - run: yarn release ${{ github.event.inputs.increment }} + - name: Run release-it + run: | + if [ "${{ inputs.release_type }}" == "prerelease" ]; then + yarn release --ci ${{ inputs.increment }} --preRelease=${{ inputs.dist_tag }} --github.preRelease + else + yarn release --ci ${{ inputs.increment }} + fi env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.release-it.json b/.release-it.json index 852676e..b21e106 100644 --- a/.release-it.json +++ b/.release-it.json @@ -8,6 +8,9 @@ "github": { "release": true }, + "npm": { + "skipChecks": true + }, "plugins": { "@release-it/conventional-changelog": { "infile": "CHANGELOG.md", From f9994d5a76052a00a6cf47fad203c032ede73df5 Mon Sep 17 00:00:00 2001 From: nicksteffens Date: Fri, 5 Dec 2025 20:02:02 +0000 Subject: [PATCH 2/8] chore: release v2.3.2-oidc.0 --- CHANGELOG.md | 2 ++ package.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 579b4d8..1c320ca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,5 @@ +## [2.3.2-oidc.0](https://github.com/movableink/fluid/compare/2.3.1...2.3.2-oidc.0) (2025-12-05) + ## [2.3.1](https://github.com/movableink/fluid/compare/2.3.0...2.3.1) (2025-11-06) ## [2.3.0](https://github.com/movableink/fluid/compare/2.2.0...2.3.0) (2025-11-06) diff --git a/package.json b/package.json index 9db4214..d6bc7bf 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@movable/fluid", - "version": "2.3.1", + "version": "2.3.2-oidc.0", "description": "Fluid is Movable Ink's design framework for its apps.", "homepage": "https://movableink.github.io/fluid/docs", "scripts": { From 7bfd3448aa34e4c870a01ae1935687e59d39c62d Mon Sep 17 00:00:00 2001 From: Nicklas Steffens Date: Fri, 5 Dec 2025 15:39:36 -0500 Subject: [PATCH 3/8] ci: add push trigger for automatic releases on main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .github/workflows/release-it.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/release-it.yml b/.github/workflows/release-it.yml index ea17251..74bf0c2 100644 --- a/.github/workflows/release-it.yml +++ b/.github/workflows/release-it.yml @@ -1,6 +1,15 @@ name: Release on: + push: + branches: + - main + paths: + - 'addon/**/*.js' + - 'addon/**/*.hbs' + - 'addon-test-support/*' + - 'app/**/*.scss' + - 'public/*' workflow_dispatch: inputs: release_type: From 9790e255f1f7c4abf0da83f94efa9f123d4d0417 Mon Sep 17 00:00:00 2001 From: nicksteffens Date: Fri, 5 Dec 2025 20:43:47 +0000 Subject: [PATCH 4/8] chore: release v2.3.2-oidc.1 --- CHANGELOG.md | 2 ++ package.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1c320ca..8d2dd32 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,5 @@ +## [2.3.2-oidc.1](https://github.com/movableink/fluid/compare/2.3.2-oidc.0...2.3.2-oidc.1) (2025-12-05) + ## [2.3.2-oidc.0](https://github.com/movableink/fluid/compare/2.3.1...2.3.2-oidc.0) (2025-12-05) ## [2.3.1](https://github.com/movableink/fluid/compare/2.3.0...2.3.1) (2025-11-06) diff --git a/package.json b/package.json index d6bc7bf..6892b3f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@movable/fluid", - "version": "2.3.2-oidc.0", + "version": "2.3.2-oidc.1", "description": "Fluid is Movable Ink's design framework for its apps.", "homepage": "https://movableink.github.io/fluid/docs", "scripts": { From 928bda769226868501c09a1b2ee0e4d221997c72 Mon Sep 17 00:00:00 2001 From: Nicklas Steffens Date: Fri, 5 Dec 2025 15:45:48 -0500 Subject: [PATCH 5/8] ci: use npx instead of yarn release script MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .github/workflows/release-it.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-it.yml b/.github/workflows/release-it.yml index 74bf0c2..7ce05f6 100644 --- a/.github/workflows/release-it.yml +++ b/.github/workflows/release-it.yml @@ -71,9 +71,9 @@ jobs: - name: Run release-it run: | if [ "${{ inputs.release_type }}" == "prerelease" ]; then - yarn release --ci ${{ inputs.increment }} --preRelease=${{ inputs.dist_tag }} --github.preRelease + npx release-it --ci ${{ inputs.increment }} --preRelease=${{ inputs.dist_tag }} --github.preRelease else - yarn release --ci ${{ inputs.increment }} + npx release-it --ci ${{ inputs.increment }} fi env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 2cfe3d8c0ec2172f4dea16b2677dce0ee0ba37fb Mon Sep 17 00:00:00 2001 From: nicksteffens Date: Fri, 5 Dec 2025 20:47:26 +0000 Subject: [PATCH 6/8] chore: release v2.3.2-oidc.2 --- CHANGELOG.md | 2 ++ package.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8d2dd32..bffff13 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,5 @@ +## [2.3.2-oidc.2](https://github.com/movableink/fluid/compare/2.3.2-oidc.1...2.3.2-oidc.2) (2025-12-05) + ## [2.3.2-oidc.1](https://github.com/movableink/fluid/compare/2.3.2-oidc.0...2.3.2-oidc.1) (2025-12-05) ## [2.3.2-oidc.0](https://github.com/movableink/fluid/compare/2.3.1...2.3.2-oidc.0) (2025-12-05) diff --git a/package.json b/package.json index 6892b3f..26fa6e2 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@movable/fluid", - "version": "2.3.2-oidc.1", + "version": "2.3.2-oidc.2", "description": "Fluid is Movable Ink's design framework for its apps.", "homepage": "https://movableink.github.io/fluid/docs", "scripts": { From aebc40f3617107c8f3bb13f6ff6f6325dcf6cbf1 Mon Sep 17 00:00:00 2001 From: Nicklas Steffens Date: Fri, 5 Dec 2025 16:42:31 -0500 Subject: [PATCH 7/8] refactor: use npm-oidc-release action MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Simplify workflow by using the reusable npm-oidc-release action instead of inline steps. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .github/workflows/release-it.yml | 39 ++++---------------------------- 1 file changed, 5 insertions(+), 34 deletions(-) diff --git a/.github/workflows/release-it.yml b/.github/workflows/release-it.yml index 7ce05f6..aa99d10 100644 --- a/.github/workflows/release-it.yml +++ b/.github/workflows/release-it.yml @@ -39,41 +39,12 @@ jobs: steps: - uses: actions/checkout@v4 with: - fetch-depth: 0 # Necessary to generate changelog from commit history + fetch-depth: 0 - - name: Setup Node with NPM registry - uses: actions/setup-node@v4 + - uses: nicksteffens/npm-oidc-release@v1 with: - node-version: '20' - registry-url: 'https://registry.npmjs.org' - - - name: Upgrade npm for OIDC support - run: npm install -g npm@latest - - - name: git config - run: | - git config user.name "${GITHUB_ACTOR}" - git config user.email "${GITHUB_ACTOR}@users.noreply.github.com" - - - name: Get yarn cache directory path - id: yarn-cache-dir-path - run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT - - - uses: actions/cache@v4 - with: - path: ${{ steps.yarn-cache-dir-path.outputs.dir }} - key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }} - restore-keys: | - ${{ runner.os }}-yarn- - - - run: yarn install --immutable - - - name: Run release-it - run: | - if [ "${{ inputs.release_type }}" == "prerelease" ]; then - npx release-it --ci ${{ inputs.increment }} --preRelease=${{ inputs.dist_tag }} --github.preRelease - else - npx release-it --ci ${{ inputs.increment }} - fi + release_type: ${{ inputs.release_type || 'release' }} + increment: ${{ inputs.increment }} + dist_tag: ${{ inputs.dist_tag }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 7732eabe9d395062f367504bfdc5e22b56765c02 Mon Sep 17 00:00:00 2001 From: nicksteffens Date: Fri, 5 Dec 2025 21:44:44 +0000 Subject: [PATCH 8/8] chore: release v2.3.2-oidc.3 --- CHANGELOG.md | 2 ++ package.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bffff13..200efba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,5 @@ +## [2.3.2-oidc.3](https://github.com/movableink/fluid/compare/2.3.2-oidc.2...2.3.2-oidc.3) (2025-12-05) + ## [2.3.2-oidc.2](https://github.com/movableink/fluid/compare/2.3.2-oidc.1...2.3.2-oidc.2) (2025-12-05) ## [2.3.2-oidc.1](https://github.com/movableink/fluid/compare/2.3.2-oidc.0...2.3.2-oidc.1) (2025-12-05) diff --git a/package.json b/package.json index 26fa6e2..7b25cf3 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@movable/fluid", - "version": "2.3.2-oidc.2", + "version": "2.3.2-oidc.3", "description": "Fluid is Movable Ink's design framework for its apps.", "homepage": "https://movableink.github.io/fluid/docs", "scripts": {