ci(provenance): inline standalone publish workflow + auto-tag#639
Open
John-David Dalton (jdalton) wants to merge 1 commit into
Open
ci(provenance): inline standalone publish workflow + auto-tag#639John-David Dalton (jdalton) wants to merge 1 commit into
John-David Dalton (jdalton) wants to merge 1 commit into
Conversation
Replaces the `uses: SocketDev/socket-registry/.github/workflows/provenance.yml@…` call with a fully standalone publish workflow. Decouples v1.4.x from socket-registry main so future reusable-workflow changes don't drift this release branch. The inlined workflow: - checks out, sets up pnpm + Node, installs, builds, publishes via `pnpm run publish:ci -- --tag <dist-tag>`. - captures published SHA + version after a successful publish. - runs a downstream `tag-release` job that creates `v<version>` at the published SHA via `gh api` (GITHUB_TOKEN only lives in that step's env; never written to `.git/config` where untrusted code in the publish job could read it). - idempotent tag creation: no-op on same SHA, hard-fail on different SHA (GitHub Release Immutability means moving a tag is unsafe). - adds a `dry-run` input (defaults true) so accidental dispatches don't publish. Why: socket-cli 1.1.98 and 1.1.99 were published from this fleet with no git tags on origin — hand-created on 2026-05-20 from `npm view gitHead`. v1.4.x is a release branch; embedding the workflow rather than tracking socket-registry main keeps it stable across infra evolution.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uses: SocketDev/socket-registry/.github/workflows/provenance.yml@…with a fully standalone workflow so v1.4.x is decoupled from socket-registry's reusable-workflow evolution.tag-releasejob that createsv<version>git tags at the published commit SHA after a successful npm publish, idempotently.gh api(notgit push) so theGITHUB_TOKENonly lives in the tag step'senvblock — never written to.git/configwhere the publish job'spnpm installcould expose it to postinstall scripts.dry-runinput (defaultstrue) so accidental dispatches don't publish.Mirrors:
socket-cli/mainpatch (8043cf709)socket-cliv1.x PR (SocketDev/socket-cli#1322)socket-registry/mainreusable workflow update (0a96e8a5)socket-sdk-js/mainpin bump (a47e8786)Test plan
dry-run=falsecreates av<sdk_version>tag pointing at the published SHA.dry-run=trueruns build but does not publish or tag.Why
socket-cli
1.1.98and1.1.99were published from the fleet with no git tags on origin — hand-created on 2026-05-20 fromnpm view socket@<v> gitHead. v1.4.x of socket-sdk-js is the next release branch at risk; inlining (rather than tracking socket-registry main) keeps this workflow stable across infra evolution while still enforcing the new tag-creation contract.Notes
actions/checkout@8e8c483d,pnpm/action-setup@a7487c7e,actions/setup-node@53b83947) all verified against the upstream GitHub API. The pnpm action pin is the dereferenced commit SHA (the v4.1.0 tag is annotated).pnpm install --frozen-lockfileis used because this is a release-branch publish path; lockfile drift would be a release-blocker.