Centralize publishing to publish-package action#498
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR centralizes npm publishing into the existing publish-package.yml workflow so it can be reused as the single “trusted” publishing workflow (per npm’s trusted actions limitation), and updates the Mint Components release workflow to call into that centralized publisher.
Changes:
- Add
workflow_callsupport topublish-package.ymlwith new inputs and conditional version-bump behavior. - Update Mint Components release to split “versioning” from “publishing”, invoking the reusable publish workflow and gating docs deployment on publishing.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/publish-package.yml | Makes publishing workflow reusable via workflow_call, adds npm-tag input and conditional versioning steps. |
| .github/workflows/mint-components-release.yml | Refactors workflow to create version PRs, conditionally publish via reusable workflow, and deploy docs only after publish. |
Comments suppressed due to low confidence (1)
.github/workflows/publish-package.yml:68
- The
npmtagexpression starts withinputs.npm-tag, so when this workflow is called viaworkflow_callthe defaultnpm-tag: latestwill always win and the prerelease fallback (increment-type == 'prerelease' && 'next') will never be used. If you want prereleases to default tonext, adjust the expression to treat an omitted/emptynpm-tagdifferently (or change the input default) so prereleases can't be accidentally published tolatest.
- name: Generate Variables
id: vars
run: |
echo "dir=packages/${{ inputs.package }}" >> ${GITHUB_OUTPUT}
echo "npmtag=${{ inputs.npm-tag || (inputs.increment-type == 'prerelease' && 'next') || 'latest' }}" >> ${GITHUB_OUTPUT}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Jayden Chan (jayden-chan)
changed the title
Jayden Chan (jayden-chan)
requested changes
May 20, 2026
Co-authored-by: Jayden Chan <32287958+jayden-chan@users.noreply.github.com>
- Pass inputs.package and inputs.npm-tag through env vars instead of
direct ${{ }} interpolation in bash to prevent command injection
- Add npm-tag format validation (alphanumeric, hyphens, dots only)
to prevent GITHUB_OUTPUT injection via newlines
Zach Harrison (zachharrison)
approved these changes
May 20, 2026
Jayden Chan (jayden-chan)
requested changes
May 20, 2026
| workflow_call: | ||
| inputs: | ||
| package: | ||
| description: "The package to publish (must be one of: express-boilerplate, integration-boilerplate-node, logger, mint-components, program-boilerplate, program-test-suite, publish-helper)" |
There was a problem hiding this comment.
We don't want to introduce an additional location that needs to be updated whenever we want to add a new package to the list of options.
Jayden Chan (jayden-chan)
approved these changes
May 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the change
NPMJS only allows us to declare one trusted action for publishing
Type of change
Links
Checklists
Development
Paperwork
Code review