feat(release): add NPM publishing workflow#7
Merged
talissoncosta merged 7 commits intomainfrom Feb 5, 2026
Merged
Conversation
talissoncosta
force-pushed
the
feat/npm-publish
branch
from
6d6960e to
f271f17
Compare
talissoncosta
force-pushed
the
feat/npm-publish
branch
3 times, most recently
from
ffc27ed to
a55a280
Compare
- Update package.json with NPM metadata (@flagsmith/backstage-plugin) - Add release workflow with PR previews (@next tag), GitHub Release trigger, and manual dispatch - Add NPM version badge to README - Extract PR comment script to scripts/comment-pr-preview.js Closes #6423 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add Apache-2.0 LICENSE file - Add CHANGELOG.md with initial 0.1.0 release notes Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
talissoncosta
force-pushed
the
feat/npm-publish
branch
from
a55a280 to
3135fb9
Compare
Rename workflow files for better clarity and extract preview publishing into its own workflow. - Rename release.yml → publish-release.yml - Extract preview job into publish-preview.yml - Remove pull_request trigger from publish-release.yml - Update workflow display names to match Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
talissoncosta
requested review from
Zaimwa9,
gagantrivedi,
khvn26 and
matthewelwell
khvn26
reviewed
Feb 2, 2026
Remove NODE_AUTH_TOKEN from publish-release.yml to use NPM's trusted publishing (OIDC) for secure, tokenless authentication. - publish-release.yml: Uses OIDC (configured by @khvn26 on npmjs.com) - publish-preview.yml: Keeps NPM_TOKEN (OIDC doesn't support pull_request) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
talissoncosta
force-pushed
the
feat/npm-publish
branch
from
de3318e to
7f40003
Compare
Contributor
Author
|
@khvn26 Good point! I've removed the preview publishing entirely. NPM's trusted publishing (OIDC) doesn't support yarn add github:Flagsmith/flagsmith-backstage-plugin#feat/some-branchNow we only have |
Remove PR preview publishing - packages can be installed directly from git sources instead (e.g., yarn add github:Flagsmith/flagsmith-backstage-plugin#branch). This simplifies the CI setup and removes the need for NPM_TOKEN. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
khvn26
reviewed
Feb 3, 2026
khvn26
reviewed
Feb 3, 2026
Add release-please for automated release PR management and refactor publish-release.yml for better security: New: - release-please.yml: Creates/updates release PRs on main branch pushes Changes to publish-release.yml: - Trigger on tag push (v*) instead of release event - Separate build and publish jobs for OIDC security: - build: runs install/lint/test/build (no id-token permission) - publish: only downloads artifact and publishes (has id-token) - Keeps same filename to preserve npm OIDC configuration This follows the established Flagsmith pattern (flagsmith-js-client) and addresses security concerns about running build scripts with OIDC token access. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
khvn26
requested changes
Feb 5, 2026
… flag - Add release-please-config.json and .release-please-manifest.json - Remove --provenance flag (implied with trusted publishing) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
talissoncosta
force-pushed
the
feat/npm-publish
branch
from
5dbd2ca to
4902061
Compare
khvn26
reviewed
Feb 5, 2026
khvn26
approved these changes
Feb 5, 2026
Member
khvn26
left a comment
khvn26
left a comment
There was a problem hiding this comment.
Left a non-blocking comment. LGTM 👍
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds NPM publishing infrastructure for
@flagsmith/backstage-plugin.Changes
package.jsonwith NPM metadata, scoped package name, and Backstage plugin configpublish-release.yml):v*tags (created by release-please)release-please.yml):mainHow it works
main→ release-please creates/updates a release PRv*tagpublish-release.yml→ builds and publishes to NPMAuthentication
Uses NPM trusted publishing with OIDC for secure, tokenless authentication. The workflow uses
--provenancefor signed attestations (supply chain security).Security
Build and publish are separate jobs:
id-tokenpermission - runs install, lint, tests, buildid-token: write- only downloads artifact and publishesThis ensures malicious build scripts cannot access the OIDC token.
Setup Required
RELEASE_PLEASE_GITHUB_TOKEN(org-level secret)Test Plan
Closes #11