Skip to content

Setup trusted publishing for npm packages, restructure workflows#720

Merged
alexslavr merged 9 commits into
masterfrom
lavrov/trusted-publishing
Jun 15, 2026
Merged

Setup trusted publishing for npm packages, restructure workflows#720
alexslavr merged 9 commits into
masterfrom
lavrov/trusted-publishing

Conversation

@alexslavr

@alexslavr alexslavr commented May 14, 2026

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a dedicated GitHub Actions workflow intended to build and publish the project’s npm (and optionally NuGet) packages, and removes the previous “release-packages” packaging job from the main CI workflow.

Changes:

  • Added a new manually-triggered Publish workflow to pack npm packages and (on tags) publish them to npmjs, plus build NuGet packages when signing secrets are present.
  • Removed the release-packages job from CI to avoid packaging during regular CI runs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
.github/workflows/publish.yml New workflow to build/pack artifacts and publish npm packages on tag runs.
.github/workflows/ci.yml Removes the release packaging job from CI.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/publish.yml Outdated
Comment thread .github/workflows/publish.yml
Comment thread .github/workflows/publish.yml
@alexslavr alexslavr requested a review from Copilot May 14, 2026 12:52
@alexslavr alexslavr requested a review from a team May 14, 2026 12:53
@alexslavr alexslavr changed the title Add GitHub Actions workflow for npm and NuGet package publishing Setup trusted publishing for npm packages, restructure workflows May 14, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

Comment thread .github/workflows/publish.yml Outdated
Comment thread .github/workflows/publish.yml Outdated
Comment thread .github/workflows/publish.yml Outdated
Comment thread .github/workflows/publish.yml Outdated
Comment thread .github/workflows/publish.yml
Comment thread .github/workflows/publish.yml
@alexslavr alexslavr force-pushed the lavrov/trusted-publishing branch from e9365f4 to 82de3d7 Compare May 14, 2026 13:03

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

Comment thread .github/workflows/publish.yml Outdated
Comment thread .github/workflows/publish.yml
Comment thread .github/workflows/publish.yml
Comment thread .github/workflows/ci.yml

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

.github/workflows/ci.yml:116

  • This step still downloads and installs libssl1.0.0 from a raw .deb without any integrity verification. Switching to HTTPS helps, but the build can still be compromised if the file is altered upstream; add a pinned checksum/signature verification (or use a signed package repository) before dpkg -i.
        wget https://archive.ubuntu.com/ubuntu/pool/main/o/openssl1.0/libssl1.0.0_1.0.2n-1ubuntu5_amd64.deb
        sudo dpkg -i libssl1.0.0_1.0.2n-1ubuntu5_amd64.deb
        curl -L -o /opt/secure-file.zip https://github.com/appveyor/secure-file/releases/download/1.0.1/secure-file.zip
        unzip /opt/secure-file.zip -d /opt/secure-file
        dotnet /opt/secure-file/secure-file.dll -decrypt net/DevExtreme.AspNet.Data/release.snk.enc -secret ${{ env.RELEASE_KEY_SECRET }}

Comment thread .github/workflows/publish.yml
Comment thread .github/workflows/publish.yml
Comment thread .github/workflows/publish.yml
@alexslavr alexslavr merged commit c81d5a6 into master Jun 15, 2026
18 checks passed
@alexslavr alexslavr deleted the lavrov/trusted-publishing branch June 15, 2026 15:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants