chore: add npm release workflow + bump to 8.6.6#3
Conversation
Adds a Release-triggered workflow that publishes to public npm via NPM_PUBLISH_TOKEN_PHANTOM_SECURITY_BOT (mirrors react-native-webview). Bumps version to 8.6.6 to ship the maxBufferSize prop from #2.
📝 WalkthroughWalkthroughA new GitHub Actions workflow Changesnpm Release Automation
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
16-17: 🧹 Nitpick | 🔵 Trivial | 🏗️ Heavy liftPrefer npm trusted publishing (OIDC) over a long-lived publish token.
Using a repository secret token on Line 41 works, but trusted publishing removes static token exposure and improves release security posture.
Suggested direction
permissions: contents: read + id-token: write ... - name: Publish - run: npm publish --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN_PHANTOM_SECURITY_BOT }} + run: npm publish --provenance --access publicAlso applies to: 38-41
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 16 - 17, Replace the static npm repository secret token authentication (referenced around the npm publish configuration) with npm's OIDC trusted publishing setup. Update the permissions block to include id-token: write permission to allow GitHub Actions to request an OIDC token, then configure the npm authentication step to use OIDC instead of passing the NPM_TOKEN secret. This removes the need for storing and managing long-lived publish tokens, improving security by using short-lived identity tokens.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 24-26: The workflow uses floating action version tags (`@v4`) which
are vulnerable to supply chain attacks, and the checkout action persists
credentials by default which unnecessarily exposes the GITHUB_TOKEN. Replace the
floating tags in both the actions/checkout@v4 and actions/setup-node@v4
references with immutable commit SHA versions (e.g., using the full commit hash
instead of `@v4`), and add a persist-credentials: false parameter to the checkout
action to disable credential persistence in the release pipeline.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 16-17: Replace the static npm repository secret token
authentication (referenced around the npm publish configuration) with npm's OIDC
trusted publishing setup. Update the permissions block to include id-token:
write permission to allow GitHub Actions to request an OIDC token, then
configure the npm authentication step to use OIDC instead of passing the
NPM_TOKEN secret. This removes the need for storing and managing long-lived
publish tokens, improving security by using short-lived identity tokens.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9e2c243b-e905-4581-86b5-03accc78be93
📒 Files selected for processing (2)
.github/workflows/release.ymlpackage.json
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-node@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/release.yml | head -40Repository: phantom/react-native-fast-image
Length of output: 1426
Harden action references and checkout credential handling.
Lines 24 and 26 use floating action tags (@v4), and line 24 keeps credentials persisted. In a release pipeline, pin actions to immutable commit SHAs and disable persisted checkout credentials to prevent supply chain attacks and limit GITHUB_TOKEN exposure.
Suggested patch
- - uses: actions/checkout@v4
+ - uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA>
+ with:
+ persist-credentials: false
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@<FULL_LENGTH_COMMIT_SHA>
with:
node-version: 20.x
registry-url: "https://registry.npmjs.org"
scope: "`@phantom`"🧰 Tools
🪛 zizmor (1.25.2)
[warning] 24-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 26-26: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 24 - 26, The workflow uses
floating action version tags (`@v4`) which are vulnerable to supply chain attacks,
and the checkout action persists credentials by default which unnecessarily
exposes the GITHUB_TOKEN. Replace the floating tags in both the
actions/checkout@v4 and actions/setup-node@v4 references with immutable commit
SHA versions (e.g., using the full commit hash instead of `@v4`), and add a
persist-credentials: false parameter to the checkout action to disable
credential persistence in the release pipeline.
Source: Linters/SAST tools
2 participants
What
.github/workflows/release.ymlthat publishes@phantom/react-native-fast-imageto public npm on a GitHub Release (or manualworkflow_dispatch), authenticated withNPM_PUBLISH_TOKEN_PHANTOM_SECURITY_BOT(the same npm publish tokenphantom/react-native-webviewalready uses).version8.6.5 → 8.6.6to ship themaxBufferSizeprop merged in feat(ios): expose maxBufferSize to bound the animated-image frame buffer #2.Why
This repo had no working publish path: the old
ci.yml/dv-scriptsflow is dormant and is wired for public-npm semantics it never actually runs. The@phantomscope is public on npmjs.org, and the wallet's Artifactory registry proxies it, so publishing to public npm is the established pattern for these standalone RN forks (this mirrorsreact-native-webview). A Release-triggered workflow is used instead of changesets since this fork is bumped infrequently.Prerequisite
The repo needs access to the
NPM_PUBLISH_TOKEN_PHANTOM_SECURITY_BOTsecret (already used byphantom/react-native-webview). Once it's available to this repo:v8.6.6.8.6.6to npm.Then Wallet pins
8.6.6and setsmaxBufferSizeon the chat media grid.Summary by CodeRabbit