chore: keep the publish credential away from the code it publishes

[robrigo]

Why

The publish job held an OIDC id-token while it installed dependencies and ran the package lifecycle scripts, so a postinstall anywhere in either tree could mint the credential npm exchanges for a publish token. The workflow now splits: the build job runs the release gates, the install, the tests, and packs the tarball while holding no credential, and the publish job holds the id-token alone beside that prebuilt tarball, with no checkout and no dependency install.

The approval now rests on something mechanical. A build gate fails any tag whose commit is not an ancestor of main, so a green run is what the approver confirms. The gate names refs/remotes/origin/main in full, because a full-history checkout also fetches tags and git resolves a bare origin/main as refs/tags/origin/main first, which a pushed tag of that name could exploit. It runs directly after checkout, before the toolchain steps that execute configuration from the tagged commit. Every action is pinned by commit sha, and the npm CLI in the credentialed job is pinned exact and installed with --ignore-scripts.

scripts/release-notes.sh also stops printing the origin remote when it refuses a non-GitHub URL, which can carry credentials.

Validation

The workflows parse, and the mechanical checks hold: the build job carries no id-token and no environment; the publish job carries needs, the environment, id-token: write alone, and a tarball publish with --provenance --ignore-scripts; every uses line is a 40-hex sha with a version comment. The release-notes suite passes with its count unchanged from main. The split path itself runs at the next tag; the rendered workflow is the evidence until then.

[Copilot]

Pull request overview

This PR hardens the npm publishing workflow by separating build/test/package steps from the credentialed publish step, reducing exposure of the OIDC id-token to dependency lifecycle scripts and repository code execution.

Changes:

• Split .github/workflows/publish.yml into an uncredentialed build job that packs a tarball and a credentialed publish job that publishes only the prebuilt artifact.
• Add a “tag is on main” ancestry gate before running toolchain steps on tag-triggered releases.
• Avoid echoing a potentially credential-bearing origin URL in scripts/release-notes.sh, and update RELEASING.md to match the new release flow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
scripts/release-notes.sh	Stops including the origin URL in the non-GitHub error message to avoid leaking embedded credentials.
RELEASING.md	Updates release instructions to reflect the new build/publish job split and approval timing.
.github/workflows/publish.yml	Implements the split build/publish workflow, adds tag-on-main gate, and publishes from a packed tarball with --ignore-scripts.

Suppressed comments (1)

.github/workflows/publish.yml:86

• actions/download-artifact downloads via the Actions API. This job sets permissions to only id-token: write, so GITHUB_TOKEN will not have actions:* and the artifact download can fail (403 / "Resource not accessible by integration"). Add the minimal Actions permission needed to read artifacts.

    permissions:
      id-token: write

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.