From adbc2ccd2cbfbe6bac78bb6c5d15c067a2807fab Mon Sep 17 00:00:00 2001 From: raj pandey Date: Thu, 22 Oct 2026 19:28:54 +0530 Subject: [PATCH] chore(release): publish to npm with trusted publishing Replace the three release-v1-legacy workflows and release.json with one release.yml that runs on release:published, using the same filename as main so one npm trusted publisher per package covers both lines. Drop NPM_TOKEN in favour of id-token: write (OIDC), run on Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), install with a frozen lockfile and check out the release tag without persisted credentials. Each package publishes in its own step under the v1-x dist-tag, in the old order (utilities, command, config, auth, core), and is skipped when its version is already on npm. Set repository.url to the canonical git+https form that npm checks trusted publishes and provenance against. Override traverse to 0.6.14, as main does, so the pre-commit Snyk scan stops flagging prototype pollution in 0.6.11. Co-Authored-By: Claude Opus 5.5 --- .github/config/release.json | 22 ----- .github/workflows/release-v1-legacy-core.yml | 62 -------------- .../release-v1-legacy-platform-plugins.yml | 70 --------------- .github/workflows/release-v1-legacy.yml | 16 ---- .github/workflows/release.yml | 85 +++++++++++++++++++ .talismanrc | 2 + packages/contentstack-auth/package.json | 6 +- packages/contentstack-command/package.json | 6 +- packages/contentstack-config/package.json | 6 +- packages/contentstack-utilities/package.json | 3 +- packages/contentstack/package.json | 6 +- pnpm-lock.yaml | 58 ++++++++++--- pnpm-workspace.yaml | 1 + 13 files changed, 154 insertions(+), 189 deletions(-) delete mode 100755 .github/config/release.json delete mode 100644 .github/workflows/release-v1-legacy-core.yml delete mode 100644 .github/workflows/release-v1-legacy-platform-plugins.yml delete mode 100644 .github/workflows/release-v1-legacy.yml create mode 100644 .github/workflows/release.yml diff --git a/.github/config/release.json b/.github/config/release.json deleted file mode 100755 index 078a8824bf..0000000000 --- a/.github/config/release.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "releaseAll": true, - "plugins": { - "utilities": false, - "command": false, - "config": false, - "auth": false, - "export": false, - "import": false, - "clone": false, - "export-to-csv": false, - "migrate-rte": false, - "migration": false, - "seed": false, - "bootstrap": false, - "bulk-publish": false, - "dev-dependencies": false, - "launch": false, - "branches": false, - "core": false - } -} diff --git a/.github/workflows/release-v1-legacy-core.yml b/.github/workflows/release-v1-legacy-core.yml deleted file mode 100644 index cf3806f8d3..0000000000 --- a/.github/workflows/release-v1-legacy-core.yml +++ /dev/null @@ -1,62 +0,0 @@ -name: Release CLI Core v1-Legacy - -on: - workflow_call: - -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - with: - version: 10.28.0 - - uses: actions/setup-node@v4 - with: - node-version: '22.x' - - - name: Enable Corepack - run: corepack enable - - - name: Install pnpm - run: corepack prepare pnpm@10.28.0 --activate - - - name: Clean the repository - run: pnpm run clean:all - - - name: Install root dependencies - run: pnpm install --no-frozen-lockfile - - - name: Build all packages - run: pnpm -r --sort run build - - - name: Reading Configuration - id: release_config - uses: rgarcia-phi/json-to-variables@v1.1.0 - with: - filename: .github/config/release.json - prefix: release - - - name: Publishing core (Production) - id: publish-core - uses: JS-DevTools/npm-publish@v3 - with: - token: ${{ secrets.NPM_TOKEN }} - package: ./packages/contentstack/package.json - tag: v1-x - - - name: Create Core Production Release - id: create_release - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - VERSION: ${{ steps.publish-core.outputs.version }} - run: | - TAG="core@v${VERSION}" - if gh release view "$TAG" &>/dev/null; then - echo "Release $TAG already exists — skipping." - else - gh release create "$TAG" \ - --title "Core v1-Legacy $VERSION" \ - --generate-notes \ - --latest=false - fi diff --git a/.github/workflows/release-v1-legacy-platform-plugins.yml b/.github/workflows/release-v1-legacy-platform-plugins.yml deleted file mode 100644 index 7eae916e61..0000000000 --- a/.github/workflows/release-v1-legacy-platform-plugins.yml +++ /dev/null @@ -1,70 +0,0 @@ -name: Release CLI Platform Plugins v1-Legacy - -on: - workflow_call: - -jobs: - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - with: - version: 10.28.0 - - uses: actions/setup-node@v4 - with: - node-version: '22.x' - - - name: Enable Corepack - run: corepack enable - - - name: Install pnpm - run: corepack prepare pnpm@10.28.0 --activate - - - name: Clean the repository - run: pnpm run clean:all - - - name: Install root dependencies - run: pnpm install --no-frozen-lockfile - - - name: Build all plugins - run: pnpm -r --sort run build - - - name: Reading Configuration - id: release_config - uses: rgarcia-phi/json-to-variables@v1.1.0 - with: - filename: .github/config/release.json - prefix: release - - # Utilities - - name: Publishing utilities (Production) - uses: JS-DevTools/npm-publish@v3 - with: - token: ${{ secrets.NPM_TOKEN }} - package: ./packages/contentstack-utilities/package.json - tag: v1-x - - # Command - - name: Publishing command (Production) - uses: JS-DevTools/npm-publish@v3 - with: - token: ${{ secrets.NPM_TOKEN }} - package: ./packages/contentstack-command/package.json - tag: v1-x - - # Config - - name: Publishing config (Production) - uses: JS-DevTools/npm-publish@v3 - with: - token: ${{ secrets.NPM_TOKEN }} - package: ./packages/contentstack-config/package.json - tag: v1-x - - # Auth - - name: Publishing auth (Production) - uses: JS-DevTools/npm-publish@v3 - with: - token: ${{ secrets.NPM_TOKEN }} - package: ./packages/contentstack-auth/package.json - tag: v1-x diff --git a/.github/workflows/release-v1-legacy.yml b/.github/workflows/release-v1-legacy.yml deleted file mode 100644 index d0b4d02e2a..0000000000 --- a/.github/workflows/release-v1-legacy.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: CLI v1-Legacy Release - -on: - push: - branches: [v1-legacy] - workflow_dispatch: # This enables manual triggering - -jobs: - plugins: - uses: ./.github/workflows/release-v1-legacy-platform-plugins.yml - secrets: inherit - - core: - needs: plugins - uses: ./.github/workflows/release-v1-legacy-core.yml - secrets: inherit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000000..749edd309f --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,85 @@ +name: Publish packages to npmjs registry + +on: + release: + types: [published] + +jobs: + publish-npm: + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + steps: + - uses: actions/checkout@v7 + with: + ref: ${{ github.event.release.tag_name }} + persist-credentials: false + - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 + with: + version: 10.28.0 + - uses: actions/setup-node@v7 + with: + node-version: 24 + registry-url: https://registry.npmjs.org/ + cache: 'pnpm' + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Build all packages + run: pnpm -r --sort run build + + - name: Update npm + run: npm install -g npm@latest + + # Each step publishes its package unless that version is already on npm. + - name: Publish utilities + working-directory: packages/contentstack-utilities + run: | + name=$(jq -r .name package.json); version=$(jq -r .version package.json) + if npm view "$name@$version" version >/dev/null 2>&1; then + echo "skip $name@$version (already on npm)" + else + npm publish --access public --tag v1-x + fi + + - name: Publish command + working-directory: packages/contentstack-command + run: | + name=$(jq -r .name package.json); version=$(jq -r .version package.json) + if npm view "$name@$version" version >/dev/null 2>&1; then + echo "skip $name@$version (already on npm)" + else + npm publish --access public --tag v1-x + fi + + - name: Publish config + working-directory: packages/contentstack-config + run: | + name=$(jq -r .name package.json); version=$(jq -r .version package.json) + if npm view "$name@$version" version >/dev/null 2>&1; then + echo "skip $name@$version (already on npm)" + else + npm publish --access public --tag v1-x + fi + + - name: Publish auth + working-directory: packages/contentstack-auth + run: | + name=$(jq -r .name package.json); version=$(jq -r .version package.json) + if npm view "$name@$version" version >/dev/null 2>&1; then + echo "skip $name@$version (already on npm)" + else + npm publish --access public --tag v1-x + fi + + - name: Publish core + working-directory: packages/contentstack + run: | + name=$(jq -r .name package.json); version=$(jq -r .version package.json) + if npm view "$name@$version" version >/dev/null 2>&1; then + echo "skip $name@$version (already on npm)" + else + npm publish --access public --tag v1-x + fi diff --git a/.talismanrc b/.talismanrc index 09d82dff5c..589069617e 100644 --- a/.talismanrc +++ b/.talismanrc @@ -3,4 +3,6 @@ fileignoreconfig: ignore_detectors: - filecontent - base64content + - filename: .github/workflows/release.yml + checksum: e609a80736cd222cd6c25e06af85aed19d7461c367b2ff099fe899aef9475041 version: '1.0' diff --git a/packages/contentstack-auth/package.json b/packages/contentstack-auth/package.json index 5201fec29f..146b61a6f5 100644 --- a/packages/contentstack-auth/package.json +++ b/packages/contentstack-auth/package.json @@ -75,5 +75,9 @@ "auth:tokens:remove": "RMVTKN" } }, - "repository": "contentstack/cli" + "repository": { + "type": "git", + "url": "git+https://github.com/contentstack/cli.git", + "directory": "packages/contentstack-auth" + } } diff --git a/packages/contentstack-command/package.json b/packages/contentstack-command/package.json index 03b16ad05e..263f99b0bf 100644 --- a/packages/contentstack-command/package.json +++ b/packages/contentstack-command/package.json @@ -61,5 +61,9 @@ "bin": "csdx", "repositoryPrefix": "<%- repo %>/blob/main/packages/contentstack-command/<%- commandPath %>" }, - "repository": "contentstack/cli" + "repository": { + "type": "git", + "url": "git+https://github.com/contentstack/cli.git", + "directory": "packages/contentstack-command" + } } \ No newline at end of file diff --git a/packages/contentstack-config/package.json b/packages/contentstack-config/package.json index cb0590c2cc..3133a2c16c 100644 --- a/packages/contentstack-config/package.json +++ b/packages/contentstack-config/package.json @@ -90,5 +90,9 @@ "config:remove:rate-limit": "RLRM" } }, - "repository": "contentstack/cli" + "repository": { + "type": "git", + "url": "git+https://github.com/contentstack/cli.git", + "directory": "packages/contentstack-config" + } } \ No newline at end of file diff --git a/packages/contentstack-utilities/package.json b/packages/contentstack-utilities/package.json index d8e5bcacec..c7d0d167e3 100644 --- a/packages/contentstack-utilities/package.json +++ b/packages/contentstack-utilities/package.json @@ -14,7 +14,8 @@ }, "repository": { "type": "git", - "url": "" + "url": "git+https://github.com/contentstack/cli.git", + "directory": "packages/contentstack-utilities" }, "keywords": [ "contentstack", diff --git a/packages/contentstack/package.json b/packages/contentstack/package.json index 26610431d5..a2e0e62e51 100755 --- a/packages/contentstack/package.json +++ b/packages/contentstack/package.json @@ -161,5 +161,9 @@ ] } }, - "repository": "https://github.com/contentstack/cli" + "repository": { + "type": "git", + "url": "git+https://github.com/contentstack/cli.git", + "directory": "packages/contentstack" + } } \ No newline at end of file diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index acf6535feb..94f9470427 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,6 +11,7 @@ overrides: brace-expansion: 5.0.12 js-yaml: 5.4.2 fast-uri: 4.2.1 + traverse: 0.6.14 importers: @@ -417,8 +418,8 @@ importers: specifier: ^6.0.0 version: 6.0.3 traverse: - specifier: ^0.6.11 - version: 0.6.11 + specifier: 0.6.14 + version: 0.6.14 tslib: specifier: ^2.8.1 version: 2.8.1 @@ -5099,8 +5100,8 @@ packages: resolution: {integrity: sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==} engines: {node: '>=18'} - traverse@0.6.11: - resolution: {integrity: sha512-vxXDZg8/+p3gblxB6BhhG5yWVn1kGRlaL8O78UDXc3wRnPizB5g83dcvWV1jpDMIPnjZjOFuxlMmE82XJ4407w==} + traverse@0.6.14: + resolution: {integrity: sha512-CYRAVGfnSSe+4Wlof62oUH6y9fGwo0NNS84hMq76MTZtwXQU7Oqna9SgWfrCGj5JPUtHQudnIEt1BP7PInPkPQ==} engines: {node: '>= 0.4'} triple-beam@1.4.1: @@ -5210,6 +5211,10 @@ packages: resolution: {integrity: sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==} engines: {node: '>= 0.4'} + typed-array-byte-offset@1.0.5: + resolution: {integrity: sha512-0FHJvLPqZ7KJzp17O13jfsAjsqazgrxBu2zEK95PmUz8lv2+GjRuxUInCr2Rk9Dms3ihN21zJ929ZO43yJ95QQ==} + engines: {node: '>= 0.4'} + typed-array-length@1.0.8: resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==} engines: {node: '>= 0.4'} @@ -5217,8 +5222,8 @@ packages: typedarray-to-buffer@3.1.5: resolution: {integrity: sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==} - typedarray.prototype.slice@1.0.5: - resolution: {integrity: sha512-q7QNVDGTdl702bVFiI5eY4l/HkgCM6at9KhcFbgUAzezHFbOVy4+0O/lCjsABEQwbZPravVfBIiBVGo89yzHFg==} + typedarray.prototype.slice@1.0.6: + resolution: {integrity: sha512-r+7YvGfM5TkTiDQ5EqWi/Z4L4KP3jUI+YCmTtWg1tmTHUw6xladLJqzR2heMaHBIM0TTFLZmn/EkIaEHYs/bIA==} engines: {node: '>= 0.4'} typedarray@0.0.6: @@ -5365,6 +5370,10 @@ packages: resolution: {integrity: sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==} engines: {node: '>= 0.4'} + which-typed-array@1.1.24: + resolution: {integrity: sha512-wk4Mf4pR5mRP7eYuuTBCIQ9d0ud2Fv2jRLQpfgnRjbOxAFHmjKFValgTpitVKzJJS8ajnYQV2Du1SZ8j6b/EUQ==} + engines: {node: '>= 0.4'} + which@2.0.2: resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==} engines: {node: '>= 8'} @@ -6137,7 +6146,7 @@ snapshots: recheck: 4.4.5 rxjs: 6.6.7 short-uuid: 6.0.3 - traverse: 0.6.11 + traverse: 0.6.14 tslib: 2.8.1 tty-table: 4.2.3 unique-string: 2.0.0 @@ -8297,7 +8306,7 @@ snapshots: eslint-config-xo: 0.49.0(eslint@10.9.1) eslint-config-xo-space: 0.35.0(eslint@10.9.1) eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.21.0(eslint@10.9.1)(typescript@4.9.5))(eslint@10.9.1))(eslint@10.9.1) - eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.69.0(eslint@10.9.1)(typescript@4.9.5))(eslint-import-resolver-typescript@3.10.1)(eslint@10.9.1) + eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.69.0(eslint@10.9.1)(typescript@4.9.5))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.21.0(eslint@10.9.1)(typescript@4.9.5))(eslint@10.9.1))(eslint@10.9.1))(eslint@10.9.1) eslint-plugin-jsdoc: 50.8.0(eslint@10.9.1) eslint-plugin-mocha: 10.5.0(eslint@10.9.1) eslint-plugin-n: 17.24.0(eslint@10.9.1)(typescript@4.9.5) @@ -8417,7 +8426,7 @@ snapshots: - eslint-import-resolver-webpack - supports-color - eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.69.0(eslint@10.9.1)(typescript@4.9.5))(eslint-import-resolver-typescript@3.10.1)(eslint@10.9.1): + eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.69.0(eslint@10.9.1)(typescript@4.9.5))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.21.0(eslint@10.9.1)(typescript@4.9.5))(eslint@10.9.1))(eslint@10.9.1))(eslint@10.9.1): dependencies: '@rtsao/scc': 1.1.0 array-includes: 3.1.9 @@ -10979,11 +10988,13 @@ snapshots: dependencies: punycode: 2.3.1 - traverse@0.6.11: + traverse@0.6.14: dependencies: + define-data-property: 1.1.4 + es-to-primitive: 1.3.4 gopd: 1.2.0 - typedarray.prototype.slice: 1.0.5 - which-typed-array: 1.1.22 + typedarray.prototype.slice: 1.0.6 + which-typed-array: 1.1.24 triple-beam@1.4.1: {} @@ -11101,6 +11112,15 @@ snapshots: is-typed-array: 1.1.15 reflect.getprototypeof: 1.0.10 + typed-array-byte-offset@1.0.5: + dependencies: + available-typed-arrays: 1.0.7 + call-bind: 1.0.9 + for-each: 0.3.5 + gopd: 1.2.0 + is-typed-array: 1.1.15 + reflect.getprototypeof: 1.0.10 + typed-array-length@1.0.8: dependencies: call-bind: 1.0.9 @@ -11114,7 +11134,7 @@ snapshots: dependencies: is-typedarray: 1.0.0 - typedarray.prototype.slice@1.0.5: + typedarray.prototype.slice@1.0.6: dependencies: call-bind: 1.0.9 define-properties: 1.2.1 @@ -11123,7 +11143,7 @@ snapshots: get-proto: 1.0.1 math-intrinsics: 1.1.0 typed-array-buffer: 1.0.3 - typed-array-byte-offset: 1.0.4 + typed-array-byte-offset: 1.0.5 typedarray@0.0.6: {} @@ -11309,6 +11329,16 @@ snapshots: gopd: 1.2.0 has-tostringtag: 1.0.2 + which-typed-array@1.1.24: + dependencies: + available-typed-arrays: 1.0.7 + call-bind: 1.0.9 + call-bound: 1.0.4 + for-each: 0.3.5 + get-proto: 1.0.1 + gopd: 1.2.0 + has-tostringtag: 1.0.2 + which@2.0.2: dependencies: isexe: 2.0.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index b61b8b005f..17859230da 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -7,3 +7,4 @@ overrides: brace-expansion: 5.0.12 js-yaml: 5.4.2 fast-uri: 4.2.1 + traverse: 0.6.14