Skip to content

fix(ci): align publish workflow package scope #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jess Sullivan (Jesssullivan) merged 1 commit into from
Apr 28, 2026
Merged

fix(ci): align publish workflow package scope #8

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ permissions:
packages: write
jobs:
package:
uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@21e0093a7586931ee69d716387e00556c6da7738
uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@0d88ad73c6884f4854624d3a2ec4b6ce41f5bea8
with:
runner_mode: shared
shared_runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }}
Expand All @@ -33,7 +33,6 @@ jobs:
bazel_targets: "//:pkg //:test"
package_dir: ./bazel-bin/pkg
npm_access: public
github_package_name: "@tummycrypt/tinyland-security"
github_package_name: "@tinyland-inc/tinyland-security"

@greptile-apps greptile-apps Bot Apr 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Package scope rename is a breaking change for existing consumers

Renaming github_package_name from @tummycrypt/tinyland-security to @tinyland-inc/tinyland-security means the next publish will create a brand-new package entry in GitHub Packages under the @tinyland-inc scope. Any downstream project currently depending on @tummycrypt/tinyland-security will silently stop receiving updates unless its package.json is updated. Consider publishing a final deprecation notice or stub release under the old scope pointing users to the new name.

dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}
secrets:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
secrets: inherit

@greptile-apps greptile-apps Bot Apr 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security secrets: inherit passes all repository secrets

Switching from an explicit NPM_TOKEN: ${{ secrets.NPM_TOKEN }} mapping to secrets: inherit causes the reusable workflow to receive every secret in this repository's context (tokens, credentials, keys), not just NPM_TOKEN. If any future secret added to this repo is sensitive and the reusable workflow (or a step it delegates to) logs or forwards it unexpectedly, the blast radius is larger than before. This is acceptable when the callee is a fully-trusted, pinned workflow within the same org — just worth confirming that tinyland-inc/ci-templates at this SHA does not fan out secrets to third-party steps.

Loading