Reusable action for publish and test

[sheplu]

Create one reusable action for release purpose

• release allow secure publication with multiple validation required
  • user should have the permission to create a tag / release
  • an approved member (environment protection) need to approve the workflow
  • the 2FA from NPM is asked everytimes - using the wait-for-secrets action
  • npm publish rely on a granular token with mandatory 2FA
  • the token is stored in an environment that is bound to a specific protected branch / tag

[UlisesGascon]

Ideally this needs to be automated (high chances we forget as local logout) but the CLI requires the ID: npm token revoke <token-id> so in that case we need to add an additional secret 🤔

[sheplu]

This would be great to not need a specific PAT token for that :) I am still hoping that we can have tokens that are deleted automatically after a short time or after a number of usage (1 would be perfect).

For this workflows, I am not sure about the case to have a token to delete a token, and then delete the token used to delete the token 😅

[UlisesGascon]

There are some repos (probably more in the future) that might not work with this approach as they require a build step before release like codemod: (https://github.com/expressjs/codemod/blob/35e5d273b5530b4a1e2352cc849612ee39d929b6/package.json#L29)

[sheplu]

I was thinking of allowing the call of the action with a specific npm script to run for that. Would you have anything against ? Or do you see a specific way?

[bjohansebas]

We don’t need to worry about codemod, because it has a different setup for publishing (see https://github.com/expressjs/codemod/blob/main/.github/workflows/publish.yml and expressjs/codemod#100), which we’re going to start using soon.

[UlisesGascon]

I definitely will like to pin dependencies here as our tokens are used in this workflow.

[sheplu]

Fixing that in a couple minutes !

[UlisesGascon]

Suggested change

	steps:
	- name: Checkout
	uses: actions/checkout@v6
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
	with:
	egress-policy: audit
	- name: Checkout
	uses: actions/checkout@v6

Obviously we need to use egress-policy: block once the allowedlist is clear.

[sheplu]

Absolutely! Nothing against that - in the contrary it will be way better.

As this is not yet setup, I only included the base workflow