ci: publish releases to npm with trusted publishing - #10
Merged
Conversation
There is currently no CI publish path: main sits at tesla-fleet-api@0.2.1 with no way to ship it. Restores this repo's own pre-2024 convention (publish on GitHub Release published) using npm OIDC trusted publishing instead of a long-lived NPM_TOKEN secret, matching how the rest of the Teslemetry fleet publishes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Add a GitHub Actions publish workflow (.github/workflows/publish.yml) to node-tesla-fleet-api so the tesla-fleet-api npm package can be published from CI, since there is currently NO publish path (the old CI publish workflow was deleted in 2024) and 0.2.1 is sitting on main unpublished. Requirements: use npm trusted publishing (OIDC) - id-token: write permission, NO NPM_TOKEN secret - matching how the rest of the Teslemetry fleet (typescript-teslemetry, tesla-protocol) publishes; the captain is separately configuring npm trusted publishing on the npm package side. Modeled the trigger on this repo's own pre-2024 deleted publish.yaml convention (on: release: types: [published]) rather than the fleet's push-to-main + changesets flow, deliberately, because this repo is a single package with no changesets/monorepo tooling configured - copying the changesets-based flow verbatim would require bootstrapping changesets from scratch, which is out of scope. Workflow builds via 'npx tsc' (uses this repo's own pnpm + tsc build, node 22 / pnpm 10 to match the existing ci.yml) before 'npm publish --provenance --access public', so dist/ (including dist/tariff.js, dist/tariff.d.ts, dist/types/site_info.*) is guaranteed fresh before publish. Did NOT attempt to actually publish - that only happens once this merges AND the captain enables npm trusted publishing for this package. Also updated AGENTS.md's existing note about there being 'no CI publish path' to describe the new workflow instead, since that note would otherwise go stale.
What Changed
NPM_TOKENsecret.Risk Assessment
✅ Low: The publish workflow is well-bounded, satisfies the stated release-triggered OIDC publishing requirements, and now grants both repository checkout and identity-token permissions at job scope.
Testing
After installing locked dependencies to resolve the initially absent compiler, I exercised the workflow’s install/build/package path, verified the tarball contents and workflow contract, captured evidence, removed transient dependencies, and found no issues; no real npm publication was attempted, as required.
Evidence: Publish package evidence
The dry-run package is tesla-fleet-api@0.2.1 and includes fresh tariff and site_info JavaScript/declaration outputs.Evidence: Workflow contract evidence
Confirms the release trigger, OIDC permission, no npm-token secret reference, expected tool versions, build ordering, and provenance publish command.Evidence: Complete npm pack dry-run manifest
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
🔧 **Review** - 1 issue found → auto-fixed ✅
.github/workflows/publish.yml:14- The required CI publish path is not runnable as written. Job-levelpermissionsreplaces the workflow-level map, so this job receivesid-token: writebut notcontents: read; consequentlyactions/checkoutcannot access repository contents. Addcontents: readto the job permissions, or moveid-token: writeinto the top-level permissions map. This contradicts the intent requirement to “Add a GitHub Actions publish workflow ... so the tesla-fleet-api npm package can be published from CI.”🔧 Fix: Add checkout permission to publish job
✅ Re-checked - no issues remain.
✅ **Test** - passed
✅ No issues found.
npx tsc(initial setup probe; dependencies were absent)pnpm install --frozen-lockfile(workflow-equivalent locked install and prepare build)npx tsc(explicit workflow build)npm pack --dry-run --jsonwith assertions fordist/tariff.js,dist/tariff.d.ts,dist/types/site_info.js, anddist/types/site_info.d.tsFocused.github/workflows/publish.ymlcontract assertions covering the trigger, OIDC, secret absence, versions, install, build ordering, and publish commandgit status --shortafter removing transient dependencies✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.