(superset) branch fix/embedded-sdk-trusted-publishing created (now 1c60f04d95b)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch fix/embedded-sdk-trusted-publishing
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 1c60f04d95b ci(embedded-sdk): publish via npm trusted publishing (OIDC)

This branch includes the following new commits:

     new 1c60f04d95b ci(embedded-sdk): publish via npm trusted publishing (OIDC)

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: ci(embedded-sdk): publish via npm trusted publishing (OIDC)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch fix/embedded-sdk-trusted-publishing
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 1c60f04d95bd79625ce00a8acc5ce11923c608af
Author: Evan Rusackas <ev...@rusackas.com>
AuthorDate: Thu Jun 18 10:50:25 2026 -0700

    ci(embedded-sdk): publish via npm trusted publishing (OIDC)
    
    Replace the long-lived NPM_TOKEN with npm trusted publishing (OIDC). The
    prior setup failed silently for months: the token went stale while the
    version sat at 0.3.0 (already on npm, so the publish path never ran), and
    only surfaced when #40991 bumped to 0.4.0 and the release actually tried
    to publish.
    
    OIDC mints a short-lived, workflow-scoped credential per publish, so
    there is no token to expire, rotate, or leak, and npm provenance is
    enabled automatically.
    
    Changes:
    - Add `id-token: write` permission to the build job (required for the
      OIDC exchange).
    - Drop the NODE_AUTH_TOKEN env var from the publish step.
    - Remove the `config` job that gated on the NPM_TOKEN secret existing
      (no secret exists under OIDC, so it would skip forever); restrict
      publishing to the canonical repo with `github.repository ==
      'apache/superset'` instead, preserving the don't-publish-from-forks
      intent.
    - Ensure npm >= 11.5.1 (trusted publishing requirement).
    
    Requires a one-time Trusted Publisher configuration on npmjs.com for
    @superset-ui/embedded-sdk before this can be merged.
    
    Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
 .github/workflows/embedded-sdk-release.yml | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/embedded-sdk-release.yml b/.github/workflows/embedded-sdk-release.yml
index 6404284335a..04172e5a850 100644
--- a/.github/workflows/embedded-sdk-release.yml
+++ b/.github/workflows/embedded-sdk-release.yml
@@ -10,25 +10,15 @@ permissions:
   contents: read
 
 jobs:
-  config:
-    runs-on: ubuntu-24.04
-    outputs:
-      has-secrets: ${{ steps.check.outputs.has-secrets }}
-    steps:
-      - name: "Check for secrets"
-        id: check
-        shell: bash
-        run: |
-          if [ -n "${NPM_TOKEN}" ]; then
-            echo "has-secrets=1" >> "$GITHUB_OUTPUT"
-          fi
-
-        env:
-          NPM_TOKEN: ${{ (secrets.NPM_TOKEN != '') || '' }}
   build:
-    needs: config
-    if: needs.config.outputs.has-secrets
+    # Publishing uses npm trusted publishing (OIDC), so there is no NPM_TOKEN to
+    # gate on. Restrict to the canonical repo: forks cannot mint a valid OIDC
+    # token for this package and must not publish.
+    if: github.repository == 'apache/superset'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # required for npm trusted publishing (OIDC)
     defaults:
       run:
         working-directory: superset-embedded-sdk
@@ -40,7 +30,8 @@ jobs:
         with:
           node-version-file: "./superset-embedded-sdk/.nvmrc"
           registry-url: "https://registry.npmjs.org"
+      # Trusted publishing requires npm >= 11.5.1; ensure it regardless of the
+      # version bundled with the pinned Node release.
+      - run: npm install -g npm@latest
       - run: npm ci
       - run: npm run ci:release
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}