Fix release pipeline to use Trusted Publishers - #4427
Conversation
Build Size ReportChanges to minified artifacts in No changesNo existing files changed. |
|
Looks good. If CI policy changed, please include a quick note confirming no downstream pipeline regressions from release pipeline change. |
|
@allejo see comment please :) @joshgoebel are you able to review please? :) |
Co-authored-by: Artur <145776561+arturict@users.noreply.github.com>
Build Size ReportChanges to minified artifacts in 1 file changedTotal change +1 B View Changes
|
I don't follow. The deployment logic remains unchanged after this PR; the pipeline behaves as follows:
Separate from the pipeline, CDNs pull the aforementioned CDN package and deploy that. I'm not sure how the CDNs are configured, but I hope they're not broken; we'll find out once things are published 😅 |
|
If we're doing something new here it'd be great to make sure it can do beta releases... I'd love to release a beta of 12 soon, but I does our release process even work right now? I'd really like to be able to release 11-stable and 12-beta concurrently for at least a little while. |
Build Size ReportChanges to minified artifacts in 3 files changedTotal change -3 B View Changes
|
Check the registry first so a re-run can finish CDN steps after a partial release without failing on "version already published". Also bump setup-node to v7.
Build Size ReportChanges to minified artifacts in 2 files changedTotal change -2 B View Changes
|
workflow_dispatch can pass any tag name; only allow the same shapes as on.push.tags so typos never publish under npm latest.
Build Size ReportChanges to minified artifacts in No changesNo existing files changed. |
joshgoebel
left a comment
joshgoebel
left a comment
There was a problem hiding this comment.
@allejo Back to you... any concerns with my changes? Just a few cleanups grok suggested. If not, this is good to go I think.
Build Size ReportChanges to minified artifacts in 3 files changedTotal change +3 B View Changes
|
|
The workflow ran successfully to publish 11.11.2 to npm and our CDN repo. The release should be available shortly. 🎉 |
4 participants
Josh, in your absence, I tagged and released 11.11.2 with all the already-merged PRs through July 2025. The new release could not be automatically published to npm or our CDN repo due to expired or revoked tokens (in December 2025, npm revoked all classic tokens).
Changes
I've logged in and configured the
highlight.jsand@highlightjs/cdn-assetspackages to use npm's new Trusted Publishers pattern.I've largely refactored the pipeline in this PR and removed a lot of the third-party actions that were previously used. The last hardcoded dry run of this action was successful. It's hard to test a production release pipeline, so I'm hoping you can serve as a second pair of eyes.
I also added a
workflow_dispatchso we can manually publish specific tags when our pipeline is broken and doesn't auto-publish, as in 11.11.2.Checklist
CHANGES.md