From 6c2bf774cdb3afb7574ba4f4fe02f5c32216f3f0 Mon Sep 17 00:00:00 2001 From: unional Date: Thu, 20 Aug 2026 01:50:47 -0700 Subject: [PATCH] ci: release through the OIDC variant of the shared workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pnpm-release-changeset.yml@v2 fails at changesets/action with "The GITHUB_TOKEN environment variable is set and does not match the github-token input". That variant passes CI_GITHUB_TOKEN both as the input and as the env var, and action v2 still reads them as different — getInput trims, process.env does not, and the org secret dates from 2022. No repo has released through it successfully. The OIDC variant passes no github-token input at all, so the env var matches the action's own ${{ github.token }} default and the check passes. It is also what repobuddy/repobuddy already releases through, and what the shared repo's README tells consumers to prefer: npm credentials are minted per run instead of living in NPM_TOKEN, and publishes carry provenance attestations. Requires a trusted publisher registered for storybook-addon-vis and vitest-plugin-vis naming this repo and release.yml. secrets: inherit goes with it — the callee reads no repo secrets now. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c1849b16..36ade858 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,12 +57,14 @@ jobs: # workflow declares must be listed here — unlisted ones drop to none, and a # callee asking for more than the caller holds fails the run at startup. permissions: + # Mints the OIDC token npm exchanges for short-lived publish credentials. id-token: write + # Lets changesets/action push the version branch and tags. contents: write + # Lets changesets/action open the "version packages" PR. pull-requests: write - uses: repobuddy/.github/.github/workflows/pnpm-release-changeset.yml@v2 + uses: repobuddy/.github/.github/workflows/pnpm-release-changeset-oidc.yml@v2 needs: verify - secrets: inherit docgen: permissions: