Merge npm publishing jobs into a single file (Trusted Publishing - OICD) #2999

jeremywiebe · 2025-10-29T18:06:01Z

Summary:

This PR co-locates the two jobs that publish to npm (release and snapshot). This is a necessity for enabling Trusted Publishing (https://docs.npmjs.com/trusted-publishers#how-trusted-publishing-works).

Once this PR has landed, we'll be able to go into each npm package's settings on npmjs.com and enable Trusted Publishing. Once that's enabled, we no longer need a npm token (stored in NPM_TOKEN) in this repo at all and will no longer have to manage an auth token for publishing to npm.

Issue: LEMS-3681

Test plan:

😅 This will be tricky.

I plan to land this PR and then enable trusted publishing for all perseus packages.
Once that's enabled, I'll try a snapshot publish by invoking it manually using workflow_dispatch
If that succeeds, I'll create a tiny release that touches all packages (I'll update/add a comment in each package's code) and then cut a release to test the release flow works also.
Finally, I'll work through the workflow files and remove references to NPM_TOKEN and remove that secret from this repo.

…r clarity

…pare for other Trusted Publisher changes

…can test by just starting the workflow. Also, change concurrency.

…o main

…completely serial with no cancellation!

…sing workflow_dispatch

github-actions · 2025-10-29T18:06:55Z

🗄️ Schema Change: No Changes ✅

github-actions · 2025-10-29T18:07:15Z

🛠️ Item Splitting: No Changes ✅

github-actions · 2025-10-29T18:07:19Z

Size Change: 0 B

Total Size: 497 kB

ℹ️ View Unchanged

Filename	Size
`packages/kas/dist/es/index.js`	20.8 kB
`packages/keypad-context/dist/es/index.js`	1 kB
`packages/kmath/dist/es/index.js`	5.98 kB
`packages/math-input/dist/es/index.js`	99.2 kB
`packages/math-input/dist/es/strings.js`	1.61 kB
`packages/perseus-core/dist/es/index.item-splitting.js`	13.1 kB
`packages/perseus-core/dist/es/index.js`	22.4 kB
`packages/perseus-editor/dist/es/index.js`	96.8 kB
`packages/perseus-linter/dist/es/index.js`	7.21 kB
`packages/perseus-score/dist/es/index.js`	9.2 kB
`packages/perseus-utils/dist/es/index.js`	403 B
`packages/perseus/dist/es/index.js`	204 kB
`packages/perseus/dist/es/strings.js`	7.73 kB
`packages/pure-markdown/dist/es/index.js`	1.39 kB
`packages/simple-markdown/dist/es/index.js`	6.71 kB

_{compressed-size-action}

github-actions · 2025-10-29T18:08:03Z

npm Snapshot: Published

Good news!! We've packaged up the latest commit from this PR (41c45a1) and published it to npm. You
can install it using the tag PR2999.

Example:

pnpm add @khanacademy/perseus@PR2999

If you are working in Khan Academy's frontend, you can run the below command.

./dev/tools/bump_perseus_version.ts -t PR2999

If you are working in Khan Academy's webapp, you can run the below command.

./dev/tools/bump_perseus_version.js -t PR2999

jeremywiebe · 2025-10-29T18:11:56Z

Verified that the snapshot publish works (it happened right on this PR!)

https://www.npmjs.com/package/@khanacademy/math-input/v/0.0.0-PR2999-20251029180740

And the Provenance reports the correct (new) workflow filename!

jeremywiebe · 2025-10-29T18:35:49Z

.github/workflows/node-ci.yml

                  label-name: item-splitting-change
                  comment-title: 🛠️ Item Splitting
-
-    publish_snapshot:


This is basically copy-pasted over to publish.yml.

jeremywiebe · 2025-10-29T18:36:26Z

.github/workflows/release.yml

@@ -1,96 +0,0 @@
-name: Release


This was all moved into publish.yml also.

jeremywiebe · 2025-10-29T18:37:18Z

.github/workflows/chromatic.yml

This workflow only deals with publishing to Chromatic, so I've renamed the workflow file to be clearer (as we do Storybook stuff elsewhere too: gh-pages.yml, which publishes Storybook to our GitHub Pages environment).

jeremywiebe · 2025-10-29T20:22:34Z

.github/workflows/publish.yml

+        inputs:
+            run_type:
+                description: "The type of publish to test"
+                required: true
+                default: "snapshot"
+                type: choice
+                options:
+                    - snapshot
+                    - release
+


Adding an input so that we can manually start either job in this file.

jeremywiebe · 2025-10-29T20:23:15Z

.github/workflows/publish.yml

+concurrency:
+    group: ${{ github.workflow }}
+    # IMPORTANT! We do not want to cancel in-progress runs, because we don't
+    # want a production publish to be interrupted by a snapshot publish ever.
+    cancel-in-progress: false


This requires attention during review. I'm setting it so this workflow can only run one job at a time. This could mean snapshots take longer, but I think it's worth protecting.

Open to thoughts on other ways or things I'm missing.

I'm pretty sure that this stuff is idempotent, so I don't think it matters if they are concurrent. Only one will win and the others will error out somehow.

I agree that we shouldn't cancel in progress though.

It's mostly idempotent. However, if there were two pushes to a PR in close succession, the earlier one could complete after the latter resulting in the wrong code being marked as the "latest" version of that snapshot on npm.

Oh! If I add the branch, then we'd have safety for snapshot runs, but would be able to run a full release with any mount of snapshots safely and simultaneously.

I'll update that.

${{ github.workflow }}-${{ github.ref }}

I feel like this race was addressed in Wonder Blocks a while back by me. I don't remember what I did though.

jeremywiebe · 2025-10-29T20:23:38Z

.github/workflows/publish.yml

+permissions:
+    id-token: write # Required for OIDC/Trusted Publishing and provenance
+    contents: write # For GitHub pages and creating release PRs
+    pull-requests: write # For snapshot PR comments
+    issues: write # For PR comments


This is the union of permissions that the release and snapshot jobs had in the other files.

Check the GitHub docs to verify what you need. At the job level, permissions are a complete overwrite, so if you want to add permissions, you also need to list the default permissions.

I don't know how workflow-level permissions integrate with job level. I would assume they are additive to avoid needing to explicitly list defaults, but worth checking to be sure.

jeremywiebe · 2025-10-29T20:24:09Z

.github/workflows/publish.yml

+        if: |
+            (github.event_name == 'workflow_dispatch' && inputs.run_type == 'release') ||
+            (github.event_name == 'push' && github.ref == 'refs/heads/main')


This is the same as the original if but adds workflow_dispatch and checking the input param to see if we're asked to run this job.

jeremywiebe · 2025-10-29T20:24:32Z

.github/workflows/publish.yml

+            id-token: write # required for publishing to npm with provenance
+            contents: write # required for creating pull requests


Actually, I don't think this is needed given we define permissions at the file-level above.

I don't think it is. I would remove it. You'll find out the first time you use this and it'll be easy to fix.

.github/workflows/publish.yml

jeremywiebe · 2025-10-29T20:25:01Z

.github/workflows/publish.yml

+            (github.event_name == 'workflow_dispatch' && inputs.run_type == 'snapshot') ||
+            (github.event_name == 'pull_request' && !startsWith(github.head_ref, 'changeset-release/'))


This is the same as the original if but adds workflow_dispatch and checking the input param to see if we're asked to run this job.

jeremywiebe · 2025-10-29T20:25:19Z

.github/workflows/publish.yml

+        permissions:
+            id-token: write # required for publishing to npm with provenance
+            pull-requests: write # required because we write a comment on the PR


Again, I think I can remove this now that we have permissions defined at the file level.

Since this will run on your PR, why not remove it and try it. Easy to fix if it's needed.

somewhatabstract

This looks good to me. Some inline comments but nothing huge.

somewhatabstract · 2025-10-31T21:10:46Z

.github/workflows/chromatic.yml

praise: Thanks for making this clarifying change!

somewhatabstract · 2025-10-31T21:14:13Z

.github/workflows/publish.yml

+concurrency:
+    group: ${{ github.workflow }}
+    # IMPORTANT! We do not want to cancel in-progress runs, because we don't
+    # want a production publish to be interrupted by a snapshot publish ever.
+    cancel-in-progress: false


I'm pretty sure that this stuff is idempotent, so I don't think it matters if they are concurrent. Only one will win and the others will error out somehow.

I agree that we shouldn't cancel in progress though.

somewhatabstract · 2025-10-31T21:16:15Z

.github/workflows/publish.yml

+permissions:
+    id-token: write # Required for OIDC/Trusted Publishing and provenance
+    contents: write # For GitHub pages and creating release PRs
+    pull-requests: write # For snapshot PR comments
+    issues: write # For PR comments


Check the GitHub docs to verify what you need. At the job level, permissions are a complete overwrite, so if you want to add permissions, you also need to list the default permissions.

I don't know how workflow-level permissions integrate with job level. I would assume they are additive to avoid needing to explicitly list defaults, but worth checking to be sure.

somewhatabstract · 2025-10-31T21:17:03Z

.github/workflows/publish.yml

+            id-token: write # required for publishing to npm with provenance
+            contents: write # required for creating pull requests


I don't think it is. I would remove it. You'll find out the first time you use this and it'll be easy to fix.

.github/workflows/publish.yml

somewhatabstract · 2025-10-31T21:17:57Z

.github/workflows/publish.yml

+        permissions:
+            id-token: write # required for publishing to npm with provenance
+            pull-requests: write # required because we write a comment on the PR


Since this will run on your PR, why not remove it and try it. Easy to fix if it's needed.

…anch for publish

…of having workflow-level permissions

…NPM_TOKEN" This reverts commit ed20bfc.

jeremywiebe added 9 commits October 29, 2025 09:18

[jer/oicd-trusted-publisher] Rename storybook.yml to chromatic.yml fo…

ca7d401

…r clarity

[jer/oicd-trusted-publisher] Rename release.yml to publish.yml to pre…

d2b0f98

…pare for other Trusted Publisher changes

[jer/oicd-trusted-publisher] Add workflow_dispatch to triggers so we …

4f7ecfd

…can test by just starting the workflow. Also, change concurrency.

[jer/oicd-trusted-publisher] Adjust release job to only run on push t…

0b3bfb9

…o main

[jer/oicd-trusted-publisher] Move comment about release job

92c0e46

[jer/oicd-trusted-publisher] Update concurrency for publishing to be …

51d67a8

…completely serial with no cancellation!

[jer/oicd-trusted-publisher] Update permissions for OICD integration

c2144f3

[jer/oicd-trusted-publisher] Move snapshot publishing to publish.yml

0242baa

[jer/oicd-trusted-publisher] Enable running either publish workflow u…

3ab5504

…sing workflow_dispatch

jeremywiebe self-assigned this Oct 29, 2025

jeremywiebe added the olc-5.0.80423 label Oct 29, 2025

jeremywiebe marked this pull request as ready for review October 29, 2025 18:15

jeremywiebe requested review from a team, jandrade and somewhatabstract October 29, 2025 18:15

jeremywiebe commented Oct 29, 2025

View reviewed changes

.github/workflows/release.yml

@@ -1,96 +0,0 @@

name: Release

Copy link

Collaborator Author

jeremywiebe Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was all moved into publish.yml also.

jeremywiebe commented Oct 29, 2025

View reviewed changes

jeremywiebe requested review from Myranae, catandthemachines, handeyeco, ivyolamit, mark-fitzgerald and nishasy October 29, 2025 20:08

handeyeco approved these changes Oct 29, 2025

View reviewed changes

jeremywiebe commented Oct 29, 2025

View reviewed changes

.github/workflows/publish.yml Show resolved Hide resolved

jeremywiebe commented Oct 29, 2025

View reviewed changes

somewhatabstract approved these changes Oct 31, 2025

View reviewed changes

jeremywiebe added 4 commits November 3, 2025 10:17

[jer/oicd-trusted-publisher] Adjust concurrency to be per workflow+br…

f191a2a

…anch for publish

[jer/oicd-trusted-publisher] Move all permissions to the job instead …

070ae6e

…of having workflow-level permissions

[jer/oicd-trusted-publisher] Add comments explaining missing NPM_TOKEN

ed20bfc

Revert "[jer/oicd-trusted-publisher] Add comments explaining missing …

46a7dff

…NPM_TOKEN" This reverts commit ed20bfc.

github-actions bot added schema-change Attached to PRs when we detect Perseus Schema changes in it item-splitting-change and removed schema-change Attached to PRs when we detect Perseus Schema changes in it labels Nov 3, 2025

jeremywiebe removed the item-splitting-change label Nov 3, 2025

[jer/oicd-trusted-publisher] Add LEMS ticket TODO

41c45a1

		id-token: write # required for publishing to npm with provenance
		contents: write # required for creating pull requests

		(github.event_name == 'workflow_dispatch' && inputs.run_type == 'snapshot') \|\|
		(github.event_name == 'pull_request' && !startsWith(github.head_ref, 'changeset-release/'))

Merge npm publishing jobs into a single file (Trusted Publishing - OICD) #2999

Are you sure you want to change the base?

Merge npm publishing jobs into a single file (Trusted Publishing - OICD) #2999

Conversation

jeremywiebe commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary:

Test plan:

Uh oh!

github-actions bot commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🗄️ Schema Change: No Changes ✅

Uh oh!

github-actions bot commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛠️ Item Splitting: No Changes ✅

Uh oh!

github-actions bot commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

npm Snapshot: Published

Uh oh!

jeremywiebe commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeremywiebe Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

somewhatabstract left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

jeremywiebe commented Oct 29, 2025 •

edited

Loading

github-actions bot commented Oct 29, 2025 •

edited

Loading

github-actions bot commented Oct 29, 2025 •

edited

Loading

github-actions bot commented Oct 29, 2025 •

edited

Loading

github-actions bot commented Oct 29, 2025 •

edited

Loading

jeremywiebe commented Oct 29, 2025 •

edited

Loading

jeremywiebe Oct 29, 2025 •

edited

Loading