Skip to content

Commit aa020b2

Browse files
coyotte508coyotte508
authored
upgrade publish mechanism (#1792)
Use OIDC instead of token to publish to NPM, and use github permissions to reenable publishing to github Will be able to remove npm token from the secrets also, git push before publishing anything already tested for `@huggingface/hub`
1 parent 4a31ddc commit aa020b2

17 files changed

+280
-239
lines changed

‎.github/workflows/agents-publish.yml‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,27 +19,30 @@ defaults:
1919
run:
2020
working-directory: packages/agents
2121

22+
permissions:
23+
contents: write
24+
id-token: write
25+
packages: write
26+
2227
jobs:
2328
version_and_release:
2429
runs-on: ubuntu-latest
2530
steps:
26-
- uses: actions/checkout@v3
31+
- uses: actions/checkout@v5
2732
with:
2833
# Needed to push the tag and the commit on the main branch, otherwise we get:
2934
# > Run git push --follow-tags
3035
# remote: error: GH006: Protected branch update failed for refs/heads/main.
3136
# remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
3237
token: ${{ secrets.BOT_ACCESS_TOKEN }}
3338
- run: npm install -g corepack@latest && corepack enable
34-
- uses: actions/setup-node@v3
39+
- uses: actions/setup-node@v4
3540
with:
36-
node-version: "20"
41+
node-version: "24"
3742
cache: "pnpm"
3843
cache-dependency-path: |
3944
packages/agents/pnpm-lock.yaml
4045
packages/doc-internal/pnpm-lock.yaml
41-
# setting a registry enables the NODE_AUTH_TOKEN env variable where we can set an npm token. REQUIRED
42-
registry-url: "https://registry.npmjs.org"
4346
- run: pnpm install
4447
- run: git config --global user.name machineuser
4548
- run: git config --global user.email infra+machineuser@huggingface.co
@@ -52,19 +55,19 @@ jobs:
5255
git add ../..
5356
git commit -m "🔖 @huggingface/agents $BUMPED_VERSION"
5457
git tag "agents-v$BUMPED_VERSION"
55-
- run: pnpm --filter agents... build && pnpm publish --no-git-checks .
56-
env:
57-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
58+
5859
- run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
59-
# hack - reuse actions/setup-node@v3 just to set a new registry
60-
- uses: actions/setup-node@v3
60+
61+
- run: pnpm --filter agents... build && pnpm publish --no-git-checks .
62+
# hack - reuse actions/setup-node@v4 just to set a new registry
63+
- uses: actions/setup-node@v4
6164
with:
62-
node-version: "20"
65+
node-version: "24"
6366
registry-url: "https://npm.pkg.github.com"
64-
# Disable for now, until github supports PATs for writing github packages (https://github.com/github/roadmap/issues/558)
65-
# - run: pnpm publish --no-git-checks .
66-
# env:
67-
# NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
67+
68+
- run: pnpm publish --no-git-checks .
69+
env:
70+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6871
- name: "Update Doc"
6972
uses: peter-evans/repository-dispatch@v2
7073
with:

‎.github/workflows/blake3-wasm-publish.yml‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,26 +19,29 @@ defaults:
1919
run:
2020
working-directory: packages/blake3-wasm
2121

22+
permissions:
23+
contents: write
24+
id-token: write
25+
packages: write
26+
2227
jobs:
2328
version_and_release:
2429
runs-on: ubuntu-latest
2530
steps:
26-
- uses: actions/checkout@v3
31+
- uses: actions/checkout@v5
2732
with:
2833
# Needed to push the tag and the commit on the main branch, otherwise we get:
2934
# > Run git push --follow-tags
3035
# remote: error: GH006: Protected branch update failed for refs/heads/main.
3136
# remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
3237
token: ${{ secrets.BOT_ACCESS_TOKEN }}
3338
- run: npm install -g corepack@latest && corepack enable
34-
- uses: actions/setup-node@v3
39+
- uses: actions/setup-node@v4
3540
with:
36-
node-version: "20"
41+
node-version: "24"
3742
cache: "pnpm"
3843
cache-dependency-path: |
3944
packages/blake3-wasm/pnpm-lock.yaml
40-
# setting a registry enables the NODE_AUTH_TOKEN env variable where we can set an npm token. REQUIRED
41-
registry-url: "https://registry.npmjs.org"
4245
- run: pnpm install
4346
- run: git config --global user.name machineuser
4447
- run: git config --global user.email infra+machineuser@huggingface.co
@@ -49,16 +52,16 @@ jobs:
4952
node -e "const fs = require('fs'); const package = JSON.parse(fs.readFileSync('./package.json')); package.version = '$BUMPED_VERSION'; fs.writeFileSync('./package.json', JSON.stringify(package, null, '\t') + '\n');"
5053
git commit . -m "🔖 @huggingface/blake3-wasm $BUMPED_VERSION"
5154
git tag "blake3-wasm-v$BUMPED_VERSION"
52-
- run: pnpm publish --no-git-checks .
53-
env:
54-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
55+
5556
- run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
56-
# hack - reuse actions/setup-node@v3 just to set a new registry
57-
- uses: actions/setup-node@v3
57+
58+
- run: pnpm publish --no-git-checks .
59+
# hack - reuse actions/setup-node@v4 just to set a new registry
60+
- uses: actions/setup-node@v4
5861
with:
59-
node-version: "20"
62+
node-version: "24"
6063
registry-url: "https://npm.pkg.github.com"
61-
# Disable for now, until github supports PATs for writing github packages (https://github.com/github/roadmap/issues/558)
62-
# - run: pnpm publish --no-git-checks .
63-
# env:
64-
# NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64+
65+
- run: pnpm publish --no-git-checks .
66+
env:
67+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/blob-publish.yml‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,26 +19,29 @@ defaults:
1919
run:
2020
working-directory: packages/blob
2121

22+
permissions:
23+
contents: write
24+
id-token: write
25+
packages: write
26+
2227
jobs:
2328
version_and_release:
2429
runs-on: ubuntu-latest
2530
steps:
26-
- uses: actions/checkout@v3
31+
- uses: actions/checkout@v5
2732
with:
2833
# Needed to push the tag and the commit on the main branch, otherwise we get:
2934
# > Run git push --follow-tags
3035
# remote: error: GH006: Protected branch update failed for refs/heads/main.
3136
# remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
3237
token: ${{ secrets.BOT_ACCESS_TOKEN }}
3338
- run: npm install -g corepack@latest && corepack enable
34-
- uses: actions/setup-node@v3
39+
- uses: actions/setup-node@v4
3540
with:
36-
node-version: "20"
41+
node-version: "24"
3742
cache: "pnpm"
3843
cache-dependency-path: |
3944
packages/blob/pnpm-lock.yaml
40-
# setting a registry enables the NODE_AUTH_TOKEN env variable where we can set an npm token. REQUIRED
41-
registry-url: "https://registry.npmjs.org"
4245
- run: pnpm install
4346
- run: git config --global user.name machineuser
4447
- run: git config --global user.email infra+machineuser@huggingface.co
@@ -50,19 +53,18 @@ jobs:
5053
git commit . -m "🔖 @huggingface/blob $BUMPED_VERSION"
5154
git tag "blob-v$BUMPED_VERSION"
5255
53-
- run: pnpm publish --no-git-checks .
54-
env:
55-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
5656
- run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
57-
# hack - reuse actions/setup-node@v3 just to set a new registry
58-
- uses: actions/setup-node@v3
57+
58+
- run: pnpm publish --no-git-checks .
59+
# hack - reuse actions/setup-node@v4 just to set a new registry
60+
- uses: actions/setup-node@v4
5961
with:
60-
node-version: "20"
62+
node-version: "24"
6163
registry-url: "https://npm.pkg.github.com"
62-
# Disable for now, until github supports PATs for writing github packages (https://github.com/github/roadmap/issues/558)
63-
# - run: pnpm publish --no-git-checks .
64-
# env:
65-
# NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64+
65+
- run: pnpm publish --no-git-checks .
66+
env:
67+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6668
- name: "Update Doc"
6769
uses: peter-evans/repository-dispatch@v2
6870
with:

‎.github/workflows/dduf-publish.yml‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,26 +19,29 @@ defaults:
1919
run:
2020
working-directory: packages/dduf
2121

22+
permissions:
23+
contents: write
24+
id-token: write
25+
packages: write
26+
2227
jobs:
2328
version_and_release:
2429
runs-on: ubuntu-latest
2530
steps:
26-
- uses: actions/checkout@v3
31+
- uses: actions/checkout@v5
2732
with:
2833
# Needed to push the tag and the commit on the main branch, otherwise we get:
2934
# > Run git push --follow-tags
3035
# remote: error: GH006: Protected branch update failed for refs/heads/main.
3136
# remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
3237
token: ${{ secrets.BOT_ACCESS_TOKEN }}
3338
- run: npm install -g corepack@latest && corepack enable
34-
- uses: actions/setup-node@v3
39+
- uses: actions/setup-node@v4
3540
with:
36-
node-version: "20"
41+
node-version: "24"
3742
cache: "pnpm"
3843
cache-dependency-path: |
3944
packages/dduf/pnpm-lock.yaml
40-
# setting a registry enables the NODE_AUTH_TOKEN env variable where we can set an npm token. REQUIRED
41-
registry-url: "https://registry.npmjs.org"
4245
- run: pnpm install
4346
- run: git config --global user.name machineuser
4447
- run: git config --global user.email infra+machineuser@huggingface.co
@@ -53,19 +56,18 @@ jobs:
5356
- name: "Check Deps are published before publishing this package"
5457
run: pnpm -w check-deps blob
5558

56-
- run: pnpm publish --no-git-checks .
57-
env:
58-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
5959
- run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
60-
# hack - reuse actions/setup-node@v3 just to set a new registry
61-
- uses: actions/setup-node@v3
60+
61+
- run: pnpm publish --no-git-checks .
62+
# hack - reuse actions/setup-node@v4 just to set a new registry
63+
- uses: actions/setup-node@v4
6264
with:
63-
node-version: "20"
65+
node-version: "24"
6466
registry-url: "https://npm.pkg.github.com"
65-
# Disable for now, until github supports PATs for writing github packages (https://github.com/github/roadmap/issues/558)
66-
# - run: pnpm publish --no-git-checks .
67-
# env:
68-
# NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
67+
68+
- run: pnpm publish --no-git-checks .
69+
env:
70+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6971
- name: "Update Doc"
7072
uses: peter-evans/repository-dispatch@v2
7173
with:

‎.github/workflows/gearhash-wasm-publish.yml‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,26 +19,29 @@ defaults:
1919
run:
2020
working-directory: packages/gearhash-wasm
2121

22+
permissions:
23+
contents: write
24+
id-token: write
25+
packages: write
26+
2227
jobs:
2328
version_and_release:
2429
runs-on: ubuntu-latest
2530
steps:
26-
- uses: actions/checkout@v3
31+
- uses: actions/checkout@v5
2732
with:
2833
# Needed to push the tag and the commit on the main branch, otherwise we get:
2934
# > Run git push --follow-tags
3035
# remote: error: GH006: Protected branch update failed for refs/heads/main.
3136
# remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
3237
token: ${{ secrets.BOT_ACCESS_TOKEN }}
3338
- run: npm install -g corepack@latest && corepack enable
34-
- uses: actions/setup-node@v3
39+
- uses: actions/setup-node@v4
3540
with:
36-
node-version: "20"
41+
node-version: "24"
3742
cache: "pnpm"
3843
cache-dependency-path: |
3944
packages/gearhash-wasm/pnpm-lock.yaml
40-
# setting a registry enables the NODE_AUTH_TOKEN env variable where we can set an npm token. REQUIRED
41-
registry-url: "https://registry.npmjs.org"
4245
- run: pnpm install
4346
- run: git config --global user.name machineuser
4447
- run: git config --global user.email infra+machineuser@huggingface.co
@@ -49,16 +52,16 @@ jobs:
4952
node -e "const fs = require('fs'); const package = JSON.parse(fs.readFileSync('./package.json')); package.version = '$BUMPED_VERSION'; fs.writeFileSync('./package.json', JSON.stringify(package, null, '\t') + '\n');"
5053
git commit . -m "🔖 @huggingface/gearhash-wasm $BUMPED_VERSION"
5154
git tag "gearhash-wasm-v$BUMPED_VERSION"
52-
- run: pnpm publish --no-git-checks .
53-
env:
54-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
55+
5556
- run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
56-
# hack - reuse actions/setup-node@v3 just to set a new registry
57-
- uses: actions/setup-node@v3
57+
58+
- run: pnpm publish --no-git-checks .
59+
# hack - reuse actions/setup-node@v4 just to set a new registry
60+
- uses: actions/setup-node@v4
5861
with:
59-
node-version: "20"
62+
node-version: "24"
6063
registry-url: "https://npm.pkg.github.com"
61-
# Disable for now, until github supports PATs for writing github packages (https://github.com/github/roadmap/issues/558)
62-
# - run: pnpm publish --no-git-checks .
63-
# env:
64-
# NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64+
65+
- run: pnpm publish --no-git-checks .
66+
env:
67+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/gguf-publish.yml‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -23,26 +23,29 @@ defaults:
2323
run:
2424
working-directory: packages/gguf
2525

26+
permissions:
27+
contents: write
28+
id-token: write
29+
packages: write
30+
2631
jobs:
2732
version_and_release:
2833
runs-on: ubuntu-latest
2934
steps:
30-
- uses: actions/checkout@v3
35+
- uses: actions/checkout@v5
3136
with:
3237
# Needed to push the tag and the commit on the main branch, otherwise we get:
3338
# > Run git push --follow-tags
3439
# remote: error: GH006: Protected branch update failed for refs/heads/main.
3540
# remote: error: Changes must be made through a pull request. Required status check "lint" is expected.
3641
token: ${{ secrets.BOT_ACCESS_TOKEN }}
3742
- run: npm install -g corepack@latest && corepack enable
38-
- uses: actions/setup-node@v3
43+
- uses: actions/setup-node@v4
3944
with:
40-
node-version: "20"
45+
node-version: "24"
4146
cache: "pnpm"
4247
cache-dependency-path: |
4348
packages/gguf/pnpm-lock.yaml
44-
# setting a registry enables the NODE_AUTH_TOKEN env variable where we can set an npm token. REQUIRED
45-
registry-url: "https://registry.npmjs.org"
4649
- run: pnpm install
4750
- run: git config --global user.name machineuser
4851
- run: git config --global user.email infra+machineuser@huggingface.co
@@ -58,16 +61,15 @@ jobs:
5861
name: "Check Deps are published before publishing this package"
5962
run: pnpm -w check-deps tasks
6063

61-
- run: pnpm publish --no-git-checks .
62-
env:
63-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
6464
- run: (git pull --rebase && git push --follow-tags) || (git pull --rebase && git push --follow-tags)
65-
# hack - reuse actions/setup-node@v3 just to set a new registry
66-
- uses: actions/setup-node@v3
65+
66+
- run: pnpm publish --no-git-checks .
67+
# hack - reuse actions/setup-node@v4 just to set a new registry
68+
- uses: actions/setup-node@v4
6769
with:
68-
node-version: "20"
70+
node-version: "24"
6971
registry-url: "https://npm.pkg.github.com"
70-
# Disable for now, until github supports PATs for writing github packages (https://github.com/github/roadmap/issues/558)
71-
# - run: pnpm publish --no-git-checks .
72-
# env:
73-
# NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
72+
73+
- run: pnpm publish --no-git-checks .
74+
env:
75+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/hub-publish.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,6 @@ jobs:
7474
node-version: "24"
7575
registry-url: "https://npm.pkg.github.com"
7676

77-
# Disable for now, until github supports PATs for writing github packages (https://github.com/github/roadmap/issues/558)
7877
- run: pnpm publish --no-git-checks .
7978
env:
8079
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)