chore: use NPM trusted publishing - #3071
Merged
Merged
Conversation
Copilot created this pull request from a session on behalf of
Saad Najmi (Saadnajmi)
July 31, 2026 16:18
View session
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Saad Najmi (Saadnajmi)
changed the title
Saad Najmi (Saadnajmi)
marked this pull request as ready for review
July 31, 2026 16:19
Saad Najmi (Saadnajmi)
requested changes
Jul 31, 2026
Saad Najmi (Saadnajmi)
changed the title
- Add enablePublishingOnGitHubActions() to configure-publish.mts so the new GHA workflow can gate publish steps via GITHUB_OUTPUT - Update apply-additional-tags.mjs to fall back to NODE_AUTH_TOKEN env var when --token is not provided; avoids token-in-process-args on GHA - Add .github/workflows/microsoft-npm-publish.yml: OIDC trusted publishing on *-stable branch pushes, with npm-publish environment protection
- Remove verbose/obvious comments from workflow and scripts - Drop --token CLI arg from apply-additional-tags.mjs; use NODE_AUTH_TOKEN env var only; update ADO job accordingly - Remove JSDoc from self-explanatory enablePublishingOnGitHubActions() - Add isGitHubActions boolean to configure-publish.mts and use it to select between ADO and GHA signaling (instead of calling both)
Saad Najmi (Saadnajmi)
force-pushed
the
copilot/switch-to-github-actions
branch
from
August 4, 2026 02:40
76a13b6 to
11a03a1
Compare
Tommy Nguyen (tido64)
approved these changes
Aug 4, 2026
Saad Najmi (Saadnajmi)
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the ADO-based npm publish pipeline with a GitHub Actions workflow that uses npm Trusted Publishing (OIDC) for the main publish step — no stored npm token required for
npm publish.Changes
.github/workflows/microsoft-npm-publish.yml— New workflow triggered on*-stablebranch pushes. Runs in annpm-publishGitHub environment (add protection rules there). Usesid-token: write+--provenanceso yarn exchanges a GitHub OIDC token directly with npmjs.com rather than a stored secret. Thenpm dist-tag addstep (applying additional dist-tags) still requires aNPM_TOKENsecret since OIDC doesn't cover that operation..ado/scripts/configure-publish.mts— AddedenablePublishingOnGitHubActions()that writespublish_react_native_macos=1toGITHUB_OUTPUT, so the new workflow can gate its publish steps on this output. Previously only the ADO##vso[task.setvariable...]signal was emitted..ado/scripts/apply-additional-tags.mjs— Token can now come fromNODE_AUTH_TOKENenv var as a fallback to--token. When using the env-var path (GHA), the token is not passed as a CLI argument —actions/setup-nodehas already wiredNODE_AUTH_TOKENinto.npmrc, sonpm dist-tag addpicks it up from there. The--tokenCLI arg path (ADO) is unchanged.Manual steps required before this workflow runs
react-native-macosand@react-native-macos/virtualized-lists— repomicrosoft/react-native-macos, workflowmicrosoft-npm-publish.yml, environmentnpm-publishnpm-publishenvironment with desired approval rulesNPM_TOKENto that environment (granular automation token scoped to the two packages, used only for dist-tag operations).ado/publish.yml