Skip to content

Preserve the trusted publisher workflow identity - #43

Merged
bigboateng merged 1 commit into
mainfrom
fix/yield-publisher-workflow-identity
Aug 7, 2026
Merged

Preserve the trusted publisher workflow identity#43
bigboateng merged 1 commit into
mainfrom
fix/yield-publisher-workflow-identity

Conversation

@bigboateng

Copy link
Copy Markdown
Contributor

Summary

  • keep the established npm-publish.yml workflow identity used by npm OIDC
  • point the combined release finalizer at that workflow
  • keep both npm and PyPI publishing in the same supervised workflow

PyPI's pending trusted publisher is also configured for npm-publish.yml.

Verification

  • npm run test:release
  • node scripts/check-release-control.mjs
  • reproduced the OIDC refusal in canary run 31216144905

@bigboateng
bigboateng merged commit 99d37b4 into main Aug 7, 2026
10 checks passed
@bigboateng
bigboateng deleted the fix/yield-publisher-workflow-identity branch August 7, 2026 20:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant