ci: configure npm trusted publishing - #54
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b9f6e523eb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| push: | ||
| branches: | ||
| - master | ||
| workflow_dispatch: |
There was a problem hiding this comment.
Adding workflow_dispatch here makes the npm publish jobs runnable manually; GitHub documents that manual runs require repository write access and let the caller select a branch (GitHub docs), while npm trusted publishing is scoped to the configured repo/workflow unless you also require a GitHub environment (npm docs). In repositories where write access is broader than release authority, or where a selected branch can alter this workflow, this bypasses the previous push-to-master/release-please gate and can publish @testplane packages from an unreviewed manual run; please require a protected environment/ref check for the dispatch path or remove the manual trigger.
Useful? React with 👍 / 👎.
1 participant
No description provided.