Pass OIDC token to yarn config

[rawagner]

Summary by CodeRabbit

• Chores
  • Updated release workflow to authenticate using OIDC tokens for Yarn operations.
  • Switched authentication to use a runtime auth token instead of registry-specific settings.
  • Removed provenance configuration from the publish step, simplifying publish metadata handling and streamlining the release process.

[coderabbitai]

Walkthrough

The GitHub Actions release workflow was changed to configure Yarn authentication using an OIDC-sourced NODE_AUTH_TOKEN (npmAuthToken) instead of npmRegistryServer/npmAlwaysAuth, and the NPM_CONFIG_PROVENANCE environment variable was removed from the Publish step.

Changes

Cohort / File(s)	Summary
GitHub Actions workflow /.github/workflows/release.yaml	Replace Yarn/npm registry config: remove npmRegistryServer and npmAlwaysAuth, add npmAuthToken set from NODE_AUTH_TOKEN (OIDC). Remove NPM_CONFIG_PROVENANCE env var from Publish step.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    actor Dev
    participant GH as GitHub Actions
    participant Step as "Configure Yarn"
    participant Registry as "npm registry"
    participant Publish as "Publish step"

    Dev->>GH: push tag / release
    GH->>Step: run configure-yarn step
    rect rgb(220, 240, 255)
      Note right of Step: Previously set\n`npmRegistryServer` + `npmAlwaysAuth`
      Step->>Registry: (OLD) use registry URL + credentials
    end
    rect rgb(235, 255, 230)
      Note right of Step: Now sets\n`npmAuthToken = NODE_AUTH_TOKEN` (OIDC)
      Step->>Registry: (NEW) authenticate via OIDC token
    end
    GH->>Publish: run publish step
    rect rgb(255, 245, 230)
      Note right of Publish: `NPM_CONFIG_PROVENANCE` removed
      Publish->>Registry: publish package using token auth
    end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

• Check that NODE_AUTH_TOKEN usage matches org OIDC configuration and registry expectations.
• Confirm removing NPM_CONFIG_PROVENANCE is intentional and acceptable for supply-chain policies.

Possibly related PRs

• Release job: Configure Yarn for npm registry #3235 — modifies .github/workflows/release.yaml Yarn/npm authentication and publish steps (auth/token handling and registry settings).

Suggested reviewers

• ammont82
• asmasarw
• celdrake

Poem

🐰 I swapped secrets for a token bright,
Yarn now hops in OIDC light.
Provenance waved a soft goodbye,
Packages publish, soaring high. ✨

Pre-merge checks and finishing touches

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title 'Pass OIDC token to yarn config' directly and accurately describes the main change in the changeset. The modifications replace npm registry configuration with OIDC token configuration for Yarn, which is exactly what the title conveys. The title is concise, clear, and specific enough for teammates to understand the primary change when scanning history.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3f33876 and 0419bc0.

📒 Files selected for processing (1)

• .github/workflows/release.yaml (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/release.yaml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)

• GitHub Check: tests
• GitHub Check: translation-files
• GitHub Check: unit-tests
• GitHub Check: circular-deps
• GitHub Check: format
• GitHub Check: lint

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[rawagner]

/cherry-pick releases/v0.1-chatbot

[openshift-cherrypick-robot]

@rawagner: once the present PR merges, I will cherry-pick it on top of releases/v0.1-chatbot in a new PR and assign it to you.

Details

In response to this:

/cherry-pick releases/v0.1-chatbot

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ammont82, rawagner

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ammont82,rawagner]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-cherrypick-robot]

@rawagner: new pull request created: #3242

Details

In response to this:

/cherry-pick releases/v0.1-chatbot

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.