Skip to content

misc: set up npm trusted publishing #16944

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lusayaa wants to merge 18 commits into
base: main
Choose a base branch
from
+78 −45
Open

misc: set up npm trusted publishing #16944

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
604b601
chore: set up npm trusted publishing
Apr 2, 2026
ad8a735
chore: upgrade npm in publish workflow
Apr 2, 2026
735b488
chore: add explicit flags to npm publish
Apr 2, 2026
62ec0b4
test dryrun
lusayaa Apr 2, 2026
b246f7e
chore: revert publish.yml and add release.yml with dry-run
Apr 3, 2026
265aefe
Merge branch 'main' into npm-trusted-publishing
Apr 3, 2026
3f9075b
chore: resolve conflict in publish.yml by reverting to main state
Apr 3, 2026
8f349a4
add dry run flag
Apr 3, 2026
35fe30a
chore: add permissions to test job in release.yml
Apr 3, 2026
4db85ae
misc: rename workflow files to address review comments
Apr 3, 2026
85a26bf
feat: trigger publish on tag push and add build-all step
Apr 3, 2026
304a268
rename release.yml to publish.yml, move publish.yml to publish-nightl…
Apr 3, 2026
5e0a57d
feat: add workflow_dispatch trigger to publish.yml
Apr 3, 2026
7ff30c3
chore: move permissions to top level in publish-nightly.yml
Apr 3, 2026
c774ac0
fix comment
Apr 3, 2026
b289931
test: add temporary pull_request trigger to publish.yml
Apr 3, 2026
25cb731
npm pkg fix
Apr 3, 2026
82cf298
remove pr trigger and dry run flag
Apr 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,9 @@ jobs:
github.event_name != 'schedule' ||
Copy link
Copy Markdown
Collaborator

@connorjclark connorjclark Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what's the goal here? this job is a cron for nightly publishing but we disabled it awhile ago. for actual releases we don't use GHA

Copy link
Copy Markdown
Collaborator Author

@lusayaa lusayaa Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

goal is to follow https://docs.npmjs.com/trusted-publishers. i think Paul already linked the GitHub publish.yml in npm to this repo. so it's a matter of linking it up on the GitHub side of things.

Copy link
Copy Markdown
Member

@paulirish paulirish Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, let's actually rename this file to publish-nightly.yml

And then we'll want to create a brand new file for publish. That is a combination of this file and whatever my skill thinks we should do.

Copy link
Copy Markdown
Member

@paulirish paulirish Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh i see you introduced a new release.yml.

yahhhhh if you're okay with it.. renaming this old file to publish-nightly and keeping the new one as publish.yml is slightly better.

Copy link
Copy Markdown
Collaborator Author

@lusayaa lusayaa Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yea that's fine. renaming it. including build-all bc it was in manual instructions...overkill?

Copy link
Copy Markdown
Member

@paulirish paulirish Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no in fact that's probably required for this to work. probably? dunno.

(github.repository == 'GoogleChrome/lighthouse' && ${{ needs.check_date.outputs.should_run != 'false' }})
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
Expand All @@ -49,9 +52,8 @@ jobs:

- name: Publish to npm
run: |
npm whoami
npm install -g npm@latest
bash $GITHUB_WORKSPACE/.github/scripts/bump-nightly-version.sh
npm publish --tag next
npm publish --provenance --access public --registry https://registry.npmjs.org/ --tag next --dry-run
env:
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
CI: true
5 changes: 4 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,10 @@
"puppeteer/**/devtools-protocol": "0.0.1527314",
"puppeteer-core/**/devtools-protocol": "0.0.1527314"
},
"repository": "GoogleChrome/lighthouse",
"repository": {
"type": "git",
"url": "https://github.com/GoogleChrome/lighthouse"
},
"keywords": [
"google",
"chrome",
Expand Down
Loading