From 51c327f0b3eb964a692c960522ce55a13b7ca70b Mon Sep 17 00:00:00 2001
From: Dhruva Reddy <dhruva@vapi.ai>
Date: Mon, 26 Oct 2026 20:04:06 -0700
Subject: [PATCH] ci: isolate npm publishing credentials from package builds

## Value

Vapi package consumers keep receiving the built release while dependency scripts and build tools lose access to npm publishing credentials. The previous job granted OIDC access during installation and builds, which allowed any code running there to request publishing credentials.

## What changed

Build, validation, version checks and packing run without OIDC permission. The package tarball is uploaded as an artifact. A separate publish job has only `id-token: write`, downloads that artifact and publishes it with lifecycle scripts disabled. It performs no checkout, dependency installation or build, and Node package-manager caching is disabled. Artifact transfer and privileged setup actions are pinned to immutable commits.

The workflow filename stays the same, so the npm trusted publisher configured on October 27 remains applicable. npm requires a first successful publish within 48 hours of creation. Recreate the configuration if it expires before that release. Existing npm token secrets remain until OIDC publication succeeds.

Library and widget builds pass. The packed widget contains the built library, declarations and embed script.

Uploaded tarballs are retained for one day. If a failed publish is retried after that, re-run all jobs to recreate the artifact.

## Testing plan

- actionlint and whitespace validation pass.
- Actual package builds and packed artifact contents checked locally.
- Tarballs exercised in dry-run mode against a disposable local registry from a clean directory without a checkout or dependencies.
- A fixture with deliberately failing lifecycle hooks fails normal packing and succeeds with scripts disabled during pack and publish dry-run.

No new version was published and no real OIDC release was triggered by this change. Final OIDC verification happens on the next intended release. Build checks use Node 22.22.3. Artifact publishing smoke checks use Node 24.19.0 with npm 12.2.1 and a disposable local registry. The workflow uses Node 24 with its bundled npm.
---
 .github/workflows/publish.yml | 60 ++++++++++++++++++++++++++++++-----
 1 file changed, 52 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f934f2c..c23704a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,19 +4,25 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
-  publish:
+  build:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: '18'
+          node-version: '24'
           cache: 'npm'
-          registry-url: 'https://registry.npmjs.org'
 
       - name: Validate version
         run: |
@@ -55,7 +61,45 @@ jobs:
       - name: Build widget
         run: npm run build:widget
 
-      - name: Publish to npm
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Pack npm artifact
+        run: |
+          mkdir -p "$RUNNER_TEMP/npm-package"
+          npm pack --ignore-scripts --pack-destination "$RUNNER_TEMP/npm-package"
+
+      - name: Upload npm artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: npm-package
+          path: ${{ runner.temp }}/npm-package/*.tgz
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      id-token: write
+    steps:
+      # Keep package code and caches out of the job with publishing authority.
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+
+      - name: Download npm artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: npm-package
+          path: .release
+
+      - name: Publish npm artifact
+        run: |
+          tarballs=(.release/*.tgz)
+          if [[ ${#tarballs[@]} -ne 1 || ! -f "${tarballs[0]}" ]]; then
+            echo "::error::Expected exactly one npm package tarball."
+            exit 1
+          fi
+          npm publish "${tarballs[0]}" --access public --ignore-scripts