2package

.github/workflows/all-nodejs-packages-publish.yaml

@@ -21,6 +21,8 @@ concurrency:
 jobs:
   build-and-publish-packages:
     runs-on: ubuntu-22.04
+    permissions: 
+      id-token: write
     steps:
       - name: Print Workflow inputs.GIT_TAG_TO_PUBLISH
         run: |
@@ -47,61 +49,63 @@ jobs:
         run: ./tools/ci.sh
         env:
           DEV_BUILD_DISABLED: false
-          FULL_BUILD_DISABLED: false
+          FULL_BUILD_DISABLED: true
           JEST_TEST_RUNNER_DISABLED: true
           TAPE_TEST_RUNNER_DISABLED: true
+          YARN_ENABLE_IMMUTABLE_INSTALLS: false
 
       - name: Check npm whoami with --registry set to npmjs
         continue-on-error: true
         run: npm whoami --registry=https://registry.npmjs.org/
 
       - name: lerna-publish-npm
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_TEST }}
+          NPM_CONFIG_PROVENANCE: true
         run: |
           git config --global user.email "[email protected]"
           git config --global user.name "hyperledger-ghci"
           npm whoami
           yarn lerna publish from-git --yes --loglevel=debug --ignore-scripts
 
-      - run: cat /home/runner/work/_temp/.npmrc
+      # - run: cat /home/runner/work/_temp/.npmrc
 
-      # Reset the .npmrc by deleting it. Invoking the setup-node action again below
-      # will set it up from scratch again but with a different registry  configuration
-      # so that we can publish to both registries instead of having to choose.
-      - run: rm /home/runner/work/_temp/.npmrc
+      # # Reset the .npmrc by deleting it. Invoking the setup-node action again below
+      # # will set it up from scratch again but with a different registry  configuration
+      # # so that we can publish to both registries instead of having to choose.
+      # - run: rm /home/runner/work/_temp/.npmrc
 
-      - uses: actions/[email protected]
-        with:
-          always-auth: true
-          node-version: ${{ env.NODEJS_VERSION }}
-          registry-url: "https://npm.pkg.github.com/"
-          scope: "@hyperledger"
+      # - uses: actions/[email protected]
+      #   with:
+      #     always-auth: true
+      #     node-version: ${{ env.NODEJS_VERSION }}
+      #     registry-url: "https://npm.pkg.github.com/"
+      #     scope: "@hyperledger"
 
-      - run: cat /home/runner/work/_temp/.npmrc
+      # - run: cat /home/runner/work/_temp/.npmrc
 
-      # Re-initialize the registries so that the @iroha2 scope gets configured in .npmrc
-      - run: yarn run init-registries
+      # # Re-initialize the registries so that the @iroha2 scope gets configured in .npmrc
+      # - run: yarn run init-registries
 
-      - run: cat /home/runner/work/_temp/.npmrc
+      # - run: cat /home/runner/work/_temp/.npmrc
 
-      - name: Check npm whoami with no --registry parameter.
-        continue-on-error: true
-        run: npm whoami
+      # - name: Check npm whoami with no --registry parameter.
+      #   continue-on-error: true
+      #   run: npm whoami
 
-      - name: Check npm whoami with --registry set to GHCR
-        continue-on-error: true
-        run: npm whoami --registry=https://npm.pkg.github.com/
+      # - name: Check npm whoami with --registry set to GHCR
+      #   continue-on-error: true
+      #   run: npm whoami --registry=https://npm.pkg.github.com/
 
-      - name: Configure git user and email
-        run: |
-          git config --global user.email "[email protected]"
-          git config --global user.name "hyperledger-ghci"
+      # - name: Configure git user and email
+      #   run: |
+      #     git config --global user.email "[email protected]"
+      #     git config --global user.name "hyperledger-ghci"
 
-      # We run the publish script a second time after having reconfigured the registry to be GHCR
-      # instead of npmjs.org so that we can publish the packages everywhere.
-      - name: lerna-publish-ghcr
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          yarn lerna publish from-git --yes --loglevel=debug --ignore-scripts
+      # # We run the publish script a second time after having reconfigured the registry to be GHCR
+      # # instead of npmjs.org so that we can publish the packages everywhere.
+      # - name: lerna-publish-ghcr
+      #   env:
+      #     NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      #   run: |
+      #     yarn lerna publish from-git --yes --loglevel=debug --ignore-scripts

.github/workflows/publish-npm.yaml

@@ -19,6 +19,8 @@ jobs:
 
   build-and-publish-packages:
     runs-on: ubuntu-22.04
+    permissions: 
+      id-token: write
     steps:
     - uses: actions/[email protected]
       with:
@@ -28,19 +30,22 @@ jobs:
       with:
         always-auth: true
         node-version: ${{ env.NODEJS_VERSION }}
-        registry-url: 'https://registry.npmjs.org'
+        registry-url: 'https://registry.npmjs.org/'
     - name: ./tools/ci.sh
       run: ./tools/ci.sh
       env:
         DEV_BUILD_DISABLED: false
-        FULL_BUILD_DISABLED: false
+        FULL_BUILD_DISABLED: true
         JEST_TEST_RUNNER_DISABLED: true
         TAPE_TEST_RUNNER_DISABLED: true
+        YARN_ENABLE_IMMUTABLE_INSTALLS: false
     - name: lerna-publish
       env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_TEST }}
+        NPM_CONFIG_PROVENANCE: true
       run: |
-        git config --global user.email "[email protected]"
-        git config --global user.name "hyperledger-ghci"
+        echo "The NPM token is: ${{ secrets.NPM_TOKEN_TEST }}"
+        git config --global user.email "adrianbatuto"
+        git config --global user.name "adrianbatuto"
         npm whoami
         yarn lerna publish from-git --yes --loglevel=debug