Update release job to use trusted-publishers flow

[rawagner]

Summary by CodeRabbit

• Chores
  • Updated internal release workflow configuration with improved authentication and modernized tooling dependencies.

[coderabbitai]

Walkthrough

GitHub Actions release workflow updated to use checkout v4 and setup-node v4, add OIDC id-token permissions, remove explicit Git user configuration, and replace NPM_AUTH_TOKEN with NPM_CONFIG_PROVENANCE for provenance-based authentication.

Changes

Cohort / File(s)	Summary
CI/CD Workflow Updates .github/workflows/release.yaml	Updated action versions (checkout v3→v4, setup-node v3→v4); added OIDC id-token write permission; removed Git user config step; replaced NPM token auth with NPM_CONFIG_PROVENANCE: true and removed NPM_AUTH_TOKEN environment variable

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Attention areas:
  • Verify OIDC id-token permissions are sufficient for the publishing step
  • Confirm NPM provenance mode compatibility with the release process and any downstream tooling
  • Validate that removing explicit Git configuration doesn't break commit/tag operations

Poem

🐰 The workflows now hop with newer might,
v4 actions bring the modern light,
OIDC tokens dance instead of plain,
Provenance provokes the supply chain,
Simplified config saves the day! ✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The PR title "Update release job to use trusted-publishers flow" directly reflects the main objective of the changeset. The summary shows that the primary change is switching from token-based NPM authentication to npm's trusted-publishers flow, which is accomplished by removing NPM_AUTH_TOKEN, enabling NPM_CONFIG_PROVENANCE, and adding OIDC id-token write permissions. The title is specific, clear, and concise—it accurately captures the key architectural change without being vague or misleading.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 663e314 and 3704f04.

📒 Files selected for processing (1)

• .github/workflows/release.yaml (4 hunks)

🔇 Additional comments (3)

.github/workflows/release.yaml (3)

11-13: ✓ Permissions correctly configured for OIDC trusted publishers.

The addition of id-token: write and contents: read permissions is the correct setup for GitHub's trusted publishers flow with NPM. This enables OIDC-based authentication without requiring long-lived secrets.

---

28-28: ✓ Action version upgrades are current and compatible.

Updated actions/checkout (v3 → v4) and actions/setup-node (v3 → v4) to latest versions. The parameter signatures remain compatible—ref, fetch-depth, cache, and node-version are all valid in v4. No breaking changes introduced.

Also applies to: 49-49

---

71-83: ✓ NPM_CONFIG_PROVENANCE correctly replaces token-based auth.

The switch from NPM_AUTH_TOKEN to NPM_CONFIG_PROVENANCE: true is the correct implementation for trusted publishers. This environment variable enables provenance signing when combined with the OIDC id-token permission, eliminating the need for static secrets.

Verification needed: Per the AI summary, explicit Git user configuration was removed. The yarn workspace version command (line 63) may require Git identity to be set for the commit/tag operations. Verify that this step still succeeds without the removed Git config. If versioning fails, the Git config step should be restored or yarn version should be called with explicit git flags.

Can you confirm that the release workflow has been tested or will be tested on a release branch to ensure the versioning step completes without the Git user configuration?

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[rawagner]

/cherry-pick releases/v0.1-chatbot

[openshift-cherrypick-robot]

@rawagner: once the present PR merges, I will cherry-pick it on top of releases/v0.1-chatbot in a new PR and assign it to you.

Details

In response to this:

/cherry-pick releases/v0.1-chatbot

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ammont82, rawagner

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ammont82,rawagner]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-cherrypick-robot]

@rawagner: new pull request created: #3230

Details

In response to this:

/cherry-pick releases/v0.1-chatbot

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.