Answer architecture round 1: the publish job's write token reaches only the tag push, publishing names main, and the audit's other findings are filed

2026-11-12 11:48:29 +01:00 · 2026-10-04 22:58:32 +02:00
parent 88ec96556c
commit e4435008ac
4 changed files with 44 additions and 9 deletions
@@ -20,13 +20,17 @@ jobs:
    concurrency:
      cancel-in-progress: false
      group: publish
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: gate
    permissions:
      contents: write
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      # The write token reaches only the tag push, never the checkout the build containers mount.
      - env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          TAG_REMOTE: https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git
        run: bash publish.sh