Skip to content

[WORKFLOW] npmjs publishing OIDC permission #2135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mmd-afegbua merged 7 commits into from
Feb 25, 2026
Merged

[WORKFLOW] npmjs publishing OIDC permission #2135

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7f874aa
added id-token write permission
mmd-afegbua Jan 26, 2026
bed6f7a
cleanup npmjs token input
mmd-afegbua Jan 26, 2026
2056f2d
test workflow
mmd-afegbua Jan 29, 2026
bca74cf
package repo url updates
mmd-afegbua Jan 30, 2026
445186b
remove old publish workflow
mmd-afegbua Feb 2, 2026
665d915
removed test trigger branch
mmd-afegbua Feb 2, 2026
533f5dc
Merge branch 'dev' into npmjs-oidc-permission
mmd-afegbua Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletions .github/workflows/cd.packages-stable.create-release-drafts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@ jobs:

runs-on: ubuntu-22.04

permissions: write-all
permissions:
contents: write

steps:
- uses: actions/checkout@v4
Expand Down Expand Up @@ -49,7 +50,9 @@ jobs:

runs-on: ubuntu-22.04

permissions: write-all
permissions:
contents: write


steps:
- uses: actions/checkout@v4
Expand Down Expand Up @@ -89,7 +92,10 @@ jobs:

runs-on: ubuntu-22.04

permissions: write-all
permissions:
contents: write
id-token: write


steps:
- uses: actions/checkout@v4
Expand Down Expand Up @@ -121,7 +127,6 @@ jobs:
tasks/npm-publish.sh packages/metadata/ latest
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPMJS_TOKEN: ${{ secrets.NPMJS_TOKEN }}

check-sdk-core-version:
name: Checking if SDK-Core should be published
Expand Down Expand Up @@ -166,7 +171,8 @@ jobs:
check-sdk-core-version,
]

permissions: write-all
permissions:
contents: write

steps:
- uses: actions/checkout@v4
Expand All @@ -193,7 +199,8 @@ jobs:

runs-on: ubuntu-22.04

permissions: write-all
permissions:
contents: write

steps:
- uses: actions/checkout@v4
Expand Down
220 changes: 214 additions & 6 deletions .github/workflows/ci.canary.yml → .../handler.publish-dev-release-packages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,20 +1,23 @@
name: CI | Canary (Dev)
name: Publisher & CI

on:
push:
branches: ["dev"]
paths:
- ".github/workflows/ci.canary.yml"
- ".github/workflows/handler.publish-dev-release-packages.yml"
- ".github/workflows/call.*.yml"
- "package.json"
- "yarn.lock"
- "packages/**"
- "codecov.yml"
# - "**.md" are commented out because docs updates should go into the packages
release:
types: [published]

jobs:
check:
name: Checking what packages need to be built
if: github.event_name == 'push'

runs-on: ubuntu-22.04

Expand Down Expand Up @@ -139,7 +142,7 @@
name: All packages tested (Dev Branch)
runs-on: ubuntu-22.04
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-not-requiring-successful-dependent-jobs
if: ${{ always() }}
if: ${{ always() && github.event_name == 'push' }}

needs: [ test-spec-haskell
, test-solidity-semantic-money
Expand Down Expand Up @@ -175,9 +178,12 @@

publish-npm-packages:
name: Publish canary packages to registries
# Only run this if we are in a push event (canary flow)
if: github.event_name == 'push'

permissions: write-all

permissions:
contents: read
id-token: write
needs: [all-packages-tested]

runs-on: ubuntu-22.04
Expand All @@ -189,6 +195,11 @@
steps:
- uses: actions/checkout@v4

- uses: actions/setup-node@v4
with:
node-version: '24'
registry-url: 'https://registry.npmjs.org'

- uses: DeterminateSystems/nix-installer-action@v13

- name: Install dependencies
Expand All @@ -208,17 +219,19 @@
yarn lerna version prerelease --yes --no-git-tag-version --preid "${preId}"

- name: Publish to npm
shell: bash
run: |
tasks/npm-publish.sh packages/ethereum-contracts/ dev --verbose
tasks/npm-publish.sh packages/sdk-core/ dev --verbose
tasks/npm-publish.sh packages/sdk-redux/ dev --verbose
tasks/npm-publish.sh packages/metadata/ dev --verbose
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPMJS_TOKEN: ${{ secrets.NPMJS_TOKEN }}

publish-sdk-html-docs:
name: Publish canary HTML docs
# Only run this if we are in a push event
if: github.event_name == 'push'

needs: [all-packages-tested]

Expand Down Expand Up @@ -273,3 +286,198 @@
s3_uri: ${{ format('{0}sdk-redux@dev', secrets.SITE_DEPLOYER_AWS_S3_DOCS_URI) }}
cloudfront_distribution_id: E3JEO5R14CT8IH

upgrade-contracts:
name: Upgrade ethereum-contracts on canary testnet (protocol release version "canary")

if: false # disable this for now

needs: [all-packages-tested]

runs-on: ubuntu-22.04

strategy:
fail-fast: false
matrix:
network: [optimism-sepolia]

defaults:
run:
shell: nix develop .#ci-default -c bash -xe {0}

steps:
- uses: actions/checkout@v4

- uses: DeterminateSystems/nix-installer-action@v13

- name: Build
run: |
yarn install --frozen-lockfile
yarn build

- name: Deploy to ${{ matrix.network }}
run: |
cd packages/ethereum-contracts
npx truffle exec --network ${{ matrix.network }} ops-scripts/deploy-test-environment.js
npx truffle exec --network ${{ matrix.network }} ops-scripts/info-print-contract-addresses.js : addresses.vars
tasks/etherscan-verify-framework.sh ${{ matrix.network }} addresses.vars
env:
RELEASE_VERSION: canary
OPTIMISM_SEPOLIA_MNEMONIC: ${{ secrets.BUILD_AGENT_MNEMONIC }}
OPTIMISM_SEPOLIA_PROVIDER_URL: ${{ secrets.OPTIMISM_SEPOLIA_PROVIDER_URL }}

publish-release:
Comment on lines +290 to +328

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 1 month ago

Generally, the fix is to explicitly declare permissions for the workflow or for the specific job, giving the GITHUB_TOKEN the least privilege it needs. For a job that only checks out code and pushes nothing back to GitHub, contents: read is sufficient.

The best targeted fix here is to add a permissions block to the upgrade-contracts job, similar to the one already used in the publish-release job but reduced to only what’s needed. The job steps only read repo contents and use secrets to deploy contracts; they do not push commits, create releases, or modify PRs. Therefore, contents: read is adequate.

Concretely, in .github/workflows/handler.publish-dev-release-packages.yml, under the upgrade-contracts job (around line 289), insert:

    permissions:
      contents: read

between the existing if: false # disable this for now and needs: [all-packages-tested]. This change does not alter any behavior besides restricting what the automatically‑provided GITHUB_TOKEN can do when/if the job is enabled.

Suggested changeset 1
.github/workflows/handler.publish-dev-release-packages.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/handler.publish-dev-release-packages.yml b/.github/workflows/handler.publish-dev-release-packages.yml
--- a/.github/workflows/handler.publish-dev-release-packages.yml
+++ b/.github/workflows/handler.publish-dev-release-packages.yml
@@ -291,6 +291,9 @@
 
     if: false # disable this for now
 
+    permissions:
+      contents: read
+
     needs: [all-packages-tested]
 
     runs-on: ubuntu-22.04
EOF
@@ -291,6 +291,9 @@

if: false # disable this for now

permissions:
contents: read

needs: [all-packages-tested]

runs-on: ubuntu-22.04
Copilot is powered by AI and may make mistakes. Always verify output.
Copy link
Contributor

@hellwolf hellwolf Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mmd-afegbua what's this

Copy link
Collaborator Author

@mmd-afegbua mmd-afegbua Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No ops. The default permission is set to read at organization level, this will be a redundant permission. Also, we'd discussed auditing the permissions and application of principle of least privilegesin the workflow, its in the backlogs.

name: Publish release package
if: github.event_name == 'release'

permissions:
contents: read
id-token: write

runs-on: ubuntu-22.04

defaults:
run:
shell: nix develop .#ci-default -c bash -xe {0}

steps:
- uses: actions/checkout@v4

- uses: actions/checkout@v4
with:
repository: superfluid-finance/build-scripts
path: build-scripts

- uses: DeterminateSystems/nix-installer-action@v13

- name: Parse Tag
env:
GITHUB_REF: ${{ github.ref }}
run: |
if echo -n "$GITHUB_REF" | grep -qE "refs/tags/ethereum-contracts@";then
echo "PUBLISH_ETHEREUM_CONTRACTS=1" >> "$GITHUB_ENV"
fi
if echo -n "$GITHUB_REF" | grep -qE "refs/tags/sdk-core@";then
echo "PUBLISH_SDK_CORE=1" >> "$GITHUB_ENV"
fi
if echo -n "$GITHUB_REF" | grep -qE "refs/tags/sdk-redux@";then
echo "PUBLISH_SDK_REDUX=1" >> "$GITHUB_ENV"
fi

- name: Install dependencies
run: yarn install --frozen-lockfile

- name: Build ethereum-contracts package
if: env.PUBLISH_ETHEREUM_CONTRACTS == 1
run: |
yarn --cwd packages/ethereum-contracts build
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Publish ethereum-contracts package
if: env.PUBLISH_ETHEREUM_CONTRACTS == 1
shell: bash
run: |
tasks/npm-publish.sh packages/ethereum-contracts/ latest
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Build sdk-core package
if: env.PUBLISH_SDK_CORE == 1
run: |
yarn --cwd packages/sdk-core get-graphql-schema:v1
yarn --cwd packages/ethereum-contracts build
yarn --cwd packages/sdk-core build
yarn --cwd packages/sdk-core doc:html
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Publish sdk-core package
id: publish-sdk-core
if: env.PUBLISH_SDK_CORE == 1
shell: bash
run: |
tasks/npm-publish.sh packages/sdk-core/ latest

PUBLISHED_VERSION=$(jq -r .version packages/sdk-core/package.json)

echo "PUBLISHED_VERSION=$PUBLISHED_VERSION" >> "$GITHUB_OUTPUT"

# Create redirect from root
mkdir sdk-core-redirect
printf '<!DOCTYPE html><html><head><title>Redirecting...</title><meta charset="UTF-8"><meta http-equiv="refresh" content="0;URL=%s" /><meta http-equiv="Cache-Control" content="no-store" /></head><body><p>Redirecting to latest documentation...</p></body></html>' "https://refs.superfluid.finance/sdk-core@$PUBLISHED_VERSION" \
> sdk-core-redirect/index.html
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Upload sdk-core HTML documentation
if: env.PUBLISH_SDK_CORE == 1
uses: ./build-scripts/s3cloudfront-hosting/actions/sync
with:
local_build_dir: packages/sdk-core/dist/docs
aws_region: eu-west-2
aws_access_key_id: ${{ secrets.SITE_DEPLOYER_AWS_ACCESS_KEY_ID }}
aws_secret_access_key: ${{ secrets.SITE_DEPLOYER_AWS_SECRET_ACCESS_KEY }}
s3_uri: ${{ format('{0}sdk-core@{1}', secrets.SITE_DEPLOYER_AWS_S3_DOCS_URI, steps.publish-sdk-core.outputs.PUBLISHED_VERSION) }}
cloudfront_distribution_id: E3JEO5R14CT8IH

- name: Upload sdk-core latest documentation redirect
if: env.PUBLISH_SDK_CORE == 1
uses: ./build-scripts/s3cloudfront-hosting/actions/sync
with:
local_build_dir: sdk-core-redirect
aws_region: eu-west-2
aws_access_key_id: ${{ secrets.SITE_DEPLOYER_AWS_ACCESS_KEY_ID }}
aws_secret_access_key: ${{ secrets.SITE_DEPLOYER_AWS_SECRET_ACCESS_KEY }}
s3_uri: ${{ format('{0}sdk-core', secrets.SITE_DEPLOYER_AWS_S3_DOCS_URI) }}
cloudfront_distribution_id: E3JEO5R14CT8IH

- name: Build sdk-redux package
if: env.PUBLISH_SDK_REDUX == 1
run: |
yarn --cwd packages/ethereum-contracts build
yarn --cwd packages/sdk-core get-graphql-schema:v1
yarn --cwd packages/sdk-core build
yarn --cwd packages/sdk-redux build
yarn --cwd packages/sdk-redux doc:html
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Publish sdk-redux package
id: publish-sdk-redux
if: env.PUBLISH_SDK_REDUX == 1
shell: bash
run: |
tasks/npm-publish.sh packages/sdk-redux/ latest

PUBLISHED_VERSION=$(jq -r .version packages/sdk-redux/package.json)

echo "PUBLISHED_VERSION=$PUBLISHED_VERSION" >> "$GITHUB_OUTPUT"

# Create redirect from root
mkdir sdk-redux-redirect
printf '<!DOCTYPE html><html><head><title>Redirecting...</title><meta charset="UTF-8"><meta http-equiv="refresh" content="0;URL=%s" /><meta http-equiv="Cache-Control" content="no-store" /></head><body><p>Redirecting to latest documentation...</p></body></html>' "https://refs.superfluid.finance/sdk-redux@$PUBLISHED_VERSION" \
> sdk-redux-redirect/index.html
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Upload sdk-redux HTML documentation
if: env.PUBLISH_SDK_REDUX == 1
uses: ./build-scripts/s3cloudfront-hosting/actions/sync
with:
local_build_dir: packages/sdk-redux/dist/docs
aws_region: eu-west-2
aws_access_key_id: ${{ secrets.SITE_DEPLOYER_AWS_ACCESS_KEY_ID }}
aws_secret_access_key: ${{ secrets.SITE_DEPLOYER_AWS_SECRET_ACCESS_KEY }}
s3_uri: ${{ format('{0}sdk-redux@{1}', secrets.SITE_DEPLOYER_AWS_S3_DOCS_URI, steps.publish-sdk-redux.outputs.PUBLISHED_VERSION) }}
cloudfront_distribution_id: E3JEO5R14CT8IH

- name: Upload sdk-redux latest documentation redirect
if: env.PUBLISH_SDK_REDUX == 1
uses: ./build-scripts/s3cloudfront-hosting/actions/sync
with:
local_build_dir: sdk-redux-redirect
aws_region: eu-west-2
aws_access_key_id: ${{ secrets.SITE_DEPLOYER_AWS_ACCESS_KEY_ID }}
aws_secret_access_key: ${{ secrets.SITE_DEPLOYER_AWS_SECRET_ACCESS_KEY }}
s3_uri: ${{ format('{0}sdk-redux', secrets.SITE_DEPLOYER_AWS_S3_DOCS_URI) }}
cloudfront_distribution_id: E3JEO5R14CT8IH
Loading
Loading