Skip to content

Release tooling: Use npm Trusted Publishing #32607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JReinhold merged 2 commits into from
Oct 2, 2025
Merged

Release tooling: Use npm Trusted Publishing #32607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
87b890d
upgrade yarn to v4.10.3
JReinhold Oct 2, 2025
19c67c7
remove npm token from publish workflow
JReinhold Oct 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version-file: '.nvmrc'
node-version-file: ".nvmrc"

- name: Cache dependencies
uses: actions/cache@v4
Expand Down Expand Up @@ -107,8 +107,6 @@ jobs:

- name: Publish
if: steps.publish-needed.outputs.published == 'false'
env:
YARN_NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: yarn release:publish --tag ${{ steps.is-prerelease.outputs.prerelease == 'true' && 'next' || 'latest' }} --verbose

- name: Get target branch
Expand Down Expand Up @@ -206,4 +204,4 @@ jobs:
DISCORD_WEBHOOK: ${{ secrets.DISCORD_MONITORING_URL }}
uses: Ilshidur/action-discord@master
with:
args: 'The GitHub Action for publishing version ${{ steps.version.outputs.current-version }} (triggered by ${{ github.triggering_actor }}) failed! See run at: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
args: "The GitHub Action for publishing version ${{ steps.version.outputs.current-version }} (triggered by ${{ github.triggering_actor }}) failed! See run at: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
942 changes: 942 additions & 0 deletions .yarn/releases/yarn-4.10.3.cjs
View file
Open in desktop

Large diffs are not rendered by default.

948 changes: 0 additions & 948 deletions .yarn/releases/yarn-4.9.1.cjs
View file
Open in desktop

This file was deleted.

3 changes: 2 additions & 1 deletion .yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,10 @@ compressionLevel: mixed

enableGlobalCache: false

yarnPath: .yarn/releases/yarn-4.9.1.cjs
installStatePath: ./.yarn/root-install-state.gz

nodeLinker: node-modules

npmPublishAccess: public

yarnPath: .yarn/releases/yarn-4.10.3.cjs
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Keep the root Yarn binary at 4.9.1.

The documented guidance for this repo explicitly requires .yarnrc.yml to point at yarn-4.9.1.cjs; updating to 4.10.3 steps outside the approved toolchain.
As per coding guidelines

-yarnPath: .yarn/releases/yarn-4.10.3.cjs
+yarnPath: .yarn/releases/yarn-4.9.1.cjs
🤖 Prompt for AI Agents 
In .yarnrc.yml around line 11, the yarnPath points to yarn-4.10.3.cjs which
violates the repo guideline that requires the root Yarn binary be pinned to
yarn-4.9.1.cjs; change the value of yarnPath to ".yarn/releases/yarn-4.9.1.cjs"
so the project uses the approved toolchain and commit the updated .yarnrc.yml.

2 changes: 1 addition & 1 deletion code/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ compressionLevel: 0

enableGlobalCache: true

yarnPath: ../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../.yarn/releases/yarn-4.10.3.cjs
installStatePath: ../.yarn/code-install-state.gz

logFilters:
Expand Down
2 changes: 1 addition & 1 deletion code/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,7 +240,7 @@
"built": false
}
},
"packageManager": "yarn@4.9.1",
"packageManager": "yarn@4.10.3",
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Restore Yarn 4.9.1 for workspace tooling.

The workspace must stick to Yarn 4.9.1 per repo guidelines; updating this packageManager entry to 4.10.3 conflicts with the mandated version.
As per coding guidelines

-  "packageManager": "[email protected]",
+  "packageManager": "[email protected]",
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"packageManager": "yarn@4.10.3",
"packageManager": "yarn@4.9.1",
🤖 Prompt for AI Agents 
In code/package.json around line 243, the packageManager field was changed to
"[email protected]" which violates the repo guideline requiring Yarn 4.9.1; revert
this entry to "[email protected]" so workspace tooling uses the mandated version and
update any related lockfile or CI configs if they reference the newer version to
remain consistent.

Copy link
Contributor Author

@JReinhold JReinhold Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai I don't know where you're getting these guidelines from? but you must update them so they reference v ^4 of yarn instead.

Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@JReinhold, you're absolutely right—I apologize for the confusion. That guideline was outdated and incorrectly pinned to Yarn 4.9.1 specifically. I've removed the old guideline and updated it to reflect that the repository uses Yarn v^4 (any 4.x version).

The upgrade to Yarn 4.10.3 is perfectly fine and aligns with keeping the tooling up to date within the v4 major version.

✏️ Learnings added 
Learnt from: JReinhold
PR: storybookjs/storybook#32607
File: code/package.json:243-243
Timestamp: 2025-10-02T09:22:13.185Z
Learning: The Storybook repository uses Yarn v^4 (any 4.x version) as the package manager, configured via .yarnrc.yml and package.json packageManager field. Specific patch versions within v4 can be upgraded as needed.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

⛔ Learnings removed 
Learnt from: CR
PR: storybookjs/storybook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-25T09:21:27.284Z
Learning: Applies to .yarnrc.yml : Use Yarn 4.9.1 as the package manager (configured via .yarnrc.yml)
🧠 Learnings used 
Learnt from: CR
PR: storybookjs/storybook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-25T09:21:27.284Z
Learning: Applies to .yarnrc.yml : Use Yarn 4.9.1 as the package manager (configured via .yarnrc.yml)

"collective": {
"type": "opencollective",
"url": "https://opencollective.com/storybook"
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
"vite-ecosystem-ci:build": "yarn task --task sandbox --template react-vite/default-ts --start-from=install --skip-cache",
"vite-ecosystem-ci:test": "yarn task --task test-runner-dev --template react-vite/default-ts --start-from=dev && yarn task --task test-runner --template react-vite/default-ts --start-from=build && yarn task --task vitest-integration --template react-vite/default-ts --start-from vitest-integration"
},
"packageManager": "yarn@4.9.1",
"packageManager": "yarn@4.10.3",
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Revert packageManager to Yarn 4.9.1.

This repo is required to stay on Yarn 4.9.1; bumping the manifest to 4.10.3 breaks that contract and risks desync with the enforced toolchain. Please keep the packageManager field at [email protected].
As per coding guidelines

-  "packageManager": "[email protected]",
+  "packageManager": "[email protected]",
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"packageManager": "yarn@4.10.3",
"packageManager": "yarn@4.9.1",
🤖 Prompt for AI Agents 
In package.json around line 25, the packageManager field was changed to
"[email protected]"; revert it back to "[email protected]" to comply with the repo toolchain.
Update the packageManager entry to exactly "[email protected]" and save the file so the
manifest matches the enforced toolchain.

"engines": {
"node": ">=22.0.0"
}
Expand Down
2 changes: 1 addition & 1 deletion scripts/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ compressionLevel: 0

enableGlobalCache: true

yarnPath: ../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../.yarn/releases/yarn-4.10.3.cjs
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Re-pin the Yarn binary to 4.9.1.

The repo mandates Yarn 4.9.1 in all .yarnrc.yml files; pointing to 4.10.3 breaks the agreed tooling baseline.
As per coding guidelines

-yarnPath: ../.yarn/releases/yarn-4.10.3.cjs
+yarnPath: ../.yarn/releases/yarn-4.9.1.cjs
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
yarnPath: ../.yarn/releases/yarn-4.10.3.cjs
yarnPath: ../.yarn/releases/yarn-4.9.1.cjs
🤖 Prompt for AI Agents 
In scripts/.yarnrc.yml around line 5, the yarnPath is pointing to
yarn-4.10.3.cjs which violates the repo's mandated Yarn version; update the
yarnPath to reference the pinned binary yarn-4.9.1.cjs (e.g.,
../.yarn/releases/yarn-4.9.1.cjs), save the file, and run or document any
follow-up steps to ensure the corresponding yarn release file exists in
.yarn/releases and then commit the change.

installStatePath: ../.yarn/scripts-install-state.gz

logFilters:
Expand Down
2 changes: 1 addition & 1 deletion scripts/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,5 +185,5 @@
"verdaccio": "^5.31.1",
"verdaccio-auth-memory": "^10.2.2"
},
"packageManager": "yarn@4.9.1"
"packageManager": "yarn@4.10.3"
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Align packageManager with required Yarn version.

This workspace also needs to stay on Yarn 4.9.1; updating to 4.10.3 conflicts with the enforced toolchain version.
As per coding guidelines

-  "packageManager": "[email protected]"
+  "packageManager": "[email protected]"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"packageManager": "yarn@4.10.3"
"packageManager": "yarn@4.9.1"
🤖 Prompt for AI Agents 
In scripts/package.json around line 188, the packageManager field was set to
"[email protected]" which conflicts with the enforced toolchain; change the value back
to "[email protected]" to match the required Yarn version and ensure consistency with
the workspace toolchain (also regenerate or verify Yarn files if needed so the
lockfile and .yarn/releases align with 4.9.1).

}
2 changes: 1 addition & 1 deletion test-storybooks/ember-cli/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
nodeLinker: node-modules
enableImmutableInstalls: false
yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
2 changes: 1 addition & 1 deletion test-storybooks/external-docs/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
nodeLinker: node-modules
enableImmutableInstalls: false
yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Restore Yarn path to the mandated 4.9.1 build.

All .yarnrc.yml files are required to target yarn-4.9.1.cjs; this bump to 4.10.3 violates the repo standard.
As per coding guidelines

-yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
+yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
🤖 Prompt for AI Agents 
In test-storybooks/external-docs/.yarnrc.yml around line 3, the yarnPath was
bumped to yarn-4.10.3.cjs which violates the repo mandate; update the yarnPath
value to ../../.yarn/releases/yarn-4.9.1.cjs so the file targets the approved
yarn-4.9.1 build, save the change, and include a brief commit message noting
restoration to the mandated yarn version.

2 changes: 1 addition & 1 deletion test-storybooks/portable-stories-kitchen-sink/nextjs/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
enableImmutableInstalls: false
nodeLinker: node-modules
yarnPath: ../../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../../.yarn/releases/yarn-4.10.3.cjs
2 changes: 1 addition & 1 deletion test-storybooks/portable-stories-kitchen-sink/react/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
yarnPath: ../../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../../.yarn/releases/yarn-4.10.3.cjs
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Revert Yarn path to the approved 4.9.1 release.

Per repo policy, .yarnrc.yml must continue pointing at yarn-4.9.1.cjs; upgrading this file to 4.10.3 conflicts with that mandate.
As per coding guidelines

-yarnPath: ../../../.yarn/releases/yarn-4.10.3.cjs
+yarnPath: ../../../.yarn/releases/yarn-4.9.1.cjs
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
yarnPath: ../../../.yarn/releases/yarn-4.10.3.cjs
yarnPath: ../../../.yarn/releases/yarn-4.9.1.cjs
🤖 Prompt for AI Agents 
In test-storybooks/portable-stories-kitchen-sink/react/.yarnrc.yml around lines
1 to 1, the yarnPath points to yarn-4.10.3.cjs which violates the repo policy
requiring yarn-4.9.1.cjs; revert the value to yarn-4.9.1.cjs so the file reads
yarnPath: ../../../.yarn/releases/yarn-4.9.1.cjs and ensure no other references
to 4.10.3 remain in this file.

2 changes: 1 addition & 1 deletion test-storybooks/portable-stories-kitchen-sink/svelte/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ enableGlobalCache: true

nodeLinker: node-modules

yarnPath: ../../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../../.yarn/releases/yarn-4.10.3.cjs
2 changes: 1 addition & 1 deletion test-storybooks/portable-stories-kitchen-sink/vue3/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ enableGlobalCache: true

nodeLinker: node-modules

yarnPath: ../../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../../.yarn/releases/yarn-4.10.3.cjs
2 changes: 1 addition & 1 deletion test-storybooks/server-kitchen-sink/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
nodeLinker: node-modules
enableImmutableInstalls: false
yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
2 changes: 1 addition & 1 deletion test-storybooks/standalone-preview/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
nodeLinker: node-modules
enableImmutableInstalls: false
yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
2 changes: 1 addition & 1 deletion test-storybooks/yarn-pnp/.yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
Copy link
Contributor

@coderabbitai coderabbitai bot Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Keep Yarn release pinned at 4.9.1.

Per repository guidance, .yarnrc.yml files must reference yarn-4.9.1.cjs. Upgrading this path to 4.10.3 violates that requirement and will desync tooling.
As per coding guidelines

-yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
+yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
yarnPath: ../../.yarn/releases/yarn-4.10.3.cjs
yarnPath: ../../.yarn/releases/yarn-4.9.1.cjs
🤖 Prompt for AI Agents 
In test-storybooks/yarn-pnp/.yarnrc.yml around lines 1 to 1, the yarnPath is set
to yarn-4.10.3.cjs which violates the repository guideline requiring
yarn-4.9.1.cjs; update the yarnPath value to ../../.yarn/releases/yarn-4.9.1.cjs
(restore the pinned release) and save the file so tooling remains in sync.


nodeLinker: pnp
Loading