ci: hardened changesets release workflow (OIDC, no stored npm token)

[thecodedrift]

Automates changeset releases so the "Version Packages" PR is rebuilt as work lands on main, and @taskless/cli publishes to npm when that PR merges — without a long-lived npm token. Adapted from the pattern in thecodedrift/firebot-script-music-to-my-ears and hardened for npm publishing. MIT licensed work

Security model

Two jobs, split by credential exposure:

• version — reads contributor-authored changesets (untrusted) and opens the Version Packages PR. No npm credential, no OIDC identity. The changeset text is fully consumed here (CHANGELOG + PR body) and never reaches the credentialed job, so a crafted changeset/PR body has nothing to steal or escape into.
• publish — runs only when main's version isn't on npm (i.e. right after the Version PR merges). By then there are no changesets left, so it sees no untrusted text and builds only reviewed, merged source. Auth is a short-lived token minted via GitHub OIDC (npm trusted publishing) — no stored NPM_TOKEN anywhere.

Also: least-privilege per job, --ignore-scripts + explicit build, --provenance, action SHAs pinned, push: main only (never pull_request_target), and no ${{ }} interpolation of untrusted text into any run:.

Residual perimeter, stated honestly: the publish job builds merged code, so what can merge to main is the real boundary — enforced by branch protection. Per discussion, we're relying on that (no approver gate) plus security-focused Copilot review rather than a manual environment gate.

Required setup before this can publish (needs npm admin)

1. Create the GitHub environment npm-production (repo Settings → Environments → New environment). No secrets needed; optionally restrict its deployment branches to main.
2. Register the npm trusted publisher on npmjs.com → @taskless/cli → Settings → Trusted Publisher → GitHub Actions, with:
   • Organization/owner: taskless
   • Repository: skills
   • Workflow filename: release.yml
   • Environment: npm-production (must match the workflow)
3. Confirm the package allows provenance/OIDC publishes (default).

Rollout sequence

Merge this → the version job auto-opens a Version Packages PR (bumps @taskless/cli 0.9.0 → 0.10.0, consumes the 3 pending changesets, runs sync-skill-versions) → do the npm setup above → merge the Version PR → the publish job publishes 0.10.0 to npm via OIDC.

Verify before un-drafting

• OIDC trusted publishing needs npm ≥ 11.5.1; the workflow upgrades npm in the publish job — confirm that satisfies it in-runner.
• We publish the single package with npm publish from packages/cli (npm's OIDC is the most mature); flag if you'd rather route through pnpm/changeset publish.

Refs the release step needed to close TSKL-245 / TSKL-270 (shipping 0.10.0).

[Copilot]

Pull request overview

Adds a hardened GitHub Actions release workflow for this repo that (1) continuously opens/updates the Changesets “Version Packages” PR on pushes to main, and (2) publishes @taskless/cli to npm via GitHub OIDC trusted publishing when the version bump lands on main, avoiding any stored long-lived npm token.

Changes:

• Introduces .github/workflows/release.yml with a two-job model: uncredentialed version (creates/updates Version Packages PR) and credentialed publish (OIDC-based npm publish gated on version-not-yet-on-npm).
• Implements least-privilege permissions per job and adds release serialization via workflow-level concurrency.
• Adds a publish gate that checks npm for the exact package version before building/publishing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.