From f01acfff2ae663443a5cb37c99fa4e9ca2ca2bce Mon Sep 17 00:00:00 2001 From: Gray Gilmore Date: Fri, 11 Sep 2026 15:51:07 -0700 Subject: [PATCH 1/2] Publish snapshots with npm trusted publishing The snapit workflow authenticated to npm with the long-lived NPM_TOKEN secret. Shopify/snapit v0.1.0 dropped token support and publishes over OIDC instead, so this bumps the action, points setup-node at the npm registry so the CLI can complete the OIDC exchange, and drops the token from the step. The comment_packages input replaces the renamed github_comment_included_packages. Assisted-By: devx/d9810122-2b8f-4f8d-b51b-eb980219e4b6 --- .github/workflows/snapit.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/snapit.yml b/.github/workflows/snapit.yml index 8a0b3356..062e7255 100644 --- a/.github/workflows/snapit.yml +++ b/.github/workflows/snapit.yml @@ -25,6 +25,7 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '24' + registry-url: 'https://registry.npmjs.org' cache: 'pnpm' - name: Install dependencies @@ -34,11 +35,10 @@ jobs: run: | printf -- "---\n'@shopify/buy-button-js': patch\n" > snapshot.txt - name: Create snapshot version - uses: Shopify/snapit@0c0d2dd62c9b0c94b7d03e1f54e72f18548e7752 # pin to a specific commit + uses: Shopify/snapit@efd7ad2bbc01ba82ac9a8495eb49b3a8eed0d9b9 # v0.1.0 with: - github_comment_included_packages: '@shopify/buy-button-js' + comment_packages: '@shopify/buy-button-js' build_script: 'pnpm run build' env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} NPM_CONFIG_PROVENANCE: true From e1b76c8f2c3366c6f4dd3a3bc32ce4ed7ec0efe6 Mon Sep 17 00:00:00 2001 From: Gray Gilmore Date: Fri, 11 Sep 2026 15:51:29 -0700 Subject: [PATCH 2/2] Release to npm with trusted publishing instead of NPM_TOKEN The release workflow already requested id-token: write for provenance but still authenticated the publish with NPM_TOKEN. Set NPM_TOKEN to an empty string so changesets/action skips writing a token to .npmrc and lets npm fall through to OIDC, and add registry-url so setup-node configures the registry the CLI exchanges the token with. changesets/action moves to v1.9.0 because token-less publishing only became a supported path in v1.7.0. Assisted-By: devx/d9810122-2b8f-4f8d-b51b-eb980219e4b6 --- .github/workflows/npm-release.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml index 3f476f08..6d2109a4 100644 --- a/.github/workflows/npm-release.yml +++ b/.github/workflows/npm-release.yml @@ -18,7 +18,7 @@ jobs: permissions: contents: write # to be able to publish a GitHub release pull-requests: write # to be able to comment on released pull requests - id-token: write # to enable use of OIDC for npm provenance + id-token: write # to enable OIDC trusted publishing to npm steps: - name: Checkout the repo uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -32,6 +32,7 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "24" + registry-url: 'https://registry.npmjs.org' cache: 'pnpm' - name: Install dependencies @@ -57,13 +58,12 @@ jobs: - name: Publish to NPM if: env.changesets_found == 'true' id: changesets - uses: changesets/action@e0538e686673de0265c8a3e2904b8c76beaa43fd # v1.5.2 + uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 with: publish: pnpm exec changeset publish env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + NPM_TOKEN: '' NPM_CONFIG_PROVENANCE: true - name: Update package.json version and reset changesets