ci: trunk-based release (publish on tags, single main branch)#57
Conversation
- publish.yml triggers on 'v*' tags instead of pushing to a release branch, and verifies the tag matches package.json before publishing - ci.yml runs on main + PRs only (drop development/production env branches) - dependabot targets main For a library, releases are npm versions marked by git tags, not deploy-style env branches. Companion manual step: rename default branch production -> main and delete development.
📝 WalkthroughWalkthroughDependabot target branches switched from development to main. CI workflow push trigger narrowed to main only. Publish workflow trigger changed from production branch push to git tag push (v*), with added tag/version verification and release creation using the triggering tag instead of creating a new tag. ChangesCI/CD Configuration Migration
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/publish.yml (1)
73-76: 🔒 Security & Privacy | 🔵 Trivial | 🏗️ Heavy liftConsider switching this publish job to npm Trusted Publishing (OIDC)
The workflow still uses
secrets.NPM_TOKENviaNODE_AUTH_TOKEN. Trusted Publishing would remove the long-lived secret, but it needsid-token: writein this job and npm-side trusted publisher setup.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml around lines 73 - 76, The Publish to npm job still relies on NODE_AUTH_TOKEN from secrets.NPM_TOKEN instead of npm Trusted Publishing. Update the publish workflow job to use OIDC by adding id-token: write to the job permissions, remove the NPM_TOKEN-based env setup from the Publish to npm step, and keep the publish command in the publish job aligned with npm Trusted Publishing requirements.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 66-71: The tag verification step in the publish workflow is
vulnerable because github.ref_name is interpolated directly into the shell
script body. Move the tag value into an env variable for the run step in the
Verify tag matches package version block, then compare that variable against
steps.pkg.outputs.version inside the shell script without direct template
expansion. Keep the existing check logic, but reference the env-bound value
instead of github.ref_name in the script.
---
Nitpick comments:
In @.github/workflows/publish.yml:
- Around line 73-76: The Publish to npm job still relies on NODE_AUTH_TOKEN from
secrets.NPM_TOKEN instead of npm Trusted Publishing. Update the publish workflow
job to use OIDC by adding id-token: write to the job permissions, remove the
NPM_TOKEN-based env setup from the Publish to npm step, and keep the publish
command in the publish job aligned with npm Trusted Publishing requirements.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 7bf4e992-f7e6-4789-b596-c79199ee5931
📒 Files selected for processing (3)
.github/dependabot.yml.github/workflows/ci.yml.github/workflows/publish.yml
💤 Files with no reviewable changes (1)
- .github/workflows/ci.yml
| - name: Verify tag matches package version | ||
| run: | | ||
| if [ "${{ github.ref_name }}" != "v${{ steps.pkg.outputs.version }}" ]; then | ||
| echo "❌ Tag ${{ github.ref_name }} does not match package.json version v${{ steps.pkg.outputs.version }}." | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Shell injection via unescaped github.ref_name interpolation.
${{ github.ref_name }} is spliced directly into the run: script body. A maliciously crafted tag name (e.g. containing quotes/backticks) can break out of the string and inject arbitrary shell commands that run with access to NPM_TOKEN/GITHUB_TOKEN. Pass the value via env instead of direct template expansion.
🔒 Proposed fix
- name: Verify tag matches package version
+ env:
+ REF_NAME: ${{ github.ref_name }}
+ PKG_VERSION: ${{ steps.pkg.outputs.version }}
run: |
- if [ "${{ github.ref_name }}" != "v${{ steps.pkg.outputs.version }}" ]; then
- echo "❌ Tag ${{ github.ref_name }} does not match package.json version v${{ steps.pkg.outputs.version }}."
+ if [ "$REF_NAME" != "v$PKG_VERSION" ]; then
+ echo "❌ Tag $REF_NAME does not match package.json version v$PKG_VERSION."
exit 1
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Verify tag matches package version | |
| run: | | |
| if [ "${{ github.ref_name }}" != "v${{ steps.pkg.outputs.version }}" ]; then | |
| echo "❌ Tag ${{ github.ref_name }} does not match package.json version v${{ steps.pkg.outputs.version }}." | |
| exit 1 | |
| fi | |
| - name: Verify tag matches package version | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| PKG_VERSION: ${{ steps.pkg.outputs.version }} | |
| run: | | |
| if [ "$REF_NAME" != "v$PKG_VERSION" ]; then | |
| echo "❌ Tag $REF_NAME does not match package.json version v$PKG_VERSION." | |
| exit 1 | |
| fi |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 68-68: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 68-68: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 69-69: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 69-69: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 66 - 71, The tag verification
step in the publish workflow is vulnerable because github.ref_name is
interpolated directly into the shell script body. Move the tag value into an env
variable for the run step in the Verify tag matches package version block, then
compare that variable against steps.pkg.outputs.version inside the shell script
without direct template expansion. Keep the existing check logic, but reference
the env-bound value instead of github.ref_name in the script.
Source: Linters/SAST tools
1 participant
For an npm library, releases are versions marked by git tags, not deploy-style environment branches. This drops the
development/productionsplit.Changes
v*tags (not push toproduction); verifies the tag matchespackage.jsonversion before publishing; GitHub release uses the pushed tag.main+ PRs only (droppeddevelopment/production).main.Release flow after this
versioninpackage.json, merge tomain.git tag vX.Y.Z && git push origin vX.Y.Z→ publish workflow runs (npm dist-tag auto: alpha/beta/rc/latest).Manual follow-up (repo settings, not in this PR)
production→main.developmentbranch.main).🤖 Generated with Claude Code
Summary by CodeRabbit
mainbranch for dependency updates and CI pushes.v*) and added a version check to prevent mismatched releases.