Repository navigation
Publish with Workload Identity - #91
Merged
Merged
Conversation
The Publish workflow exchanges the job's GitHub OIDC token for a token that can only publish castore, matched against the package's workload identity on hex.pm, so it no longer uses the HEX_API_KEY secret. The job runs in the release environment that the workload identity names and installs Hex 2.6.0-dev from a pinned hexpm/hex commit, the first Hex that publishes with Workload Identity. That Hex needs OTP 27 or later, so the job moves to OTP 28 and Elixir 1.19, the versions CI lints with. actions/checkout moves to v6, the version CI uses, because v3's Node runtime is too old for GitHub's runners.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Publish workflow exchanges the job's GitHub OIDC token for a token that can only publish castore, matched against the package's workload identity on hex.pm, instead of using the
HEX_API_KEYsecret. The job runs in thereleaseenvironment that the workload identity names, withid-token: write, and keepscontents: writefor the version tagpublish.shpushes. It installs Hex 2.6.0-dev from a pinned hexpm/hex commit, the first Hex that publishes with Workload Identity.That Hex needs OTP 27 or later, so the job moves from OTP 25.3 and Elixir 1.14.3 to OTP 28 and Elixir 1.19, the versions CI lints with.
actions/checkoutmoves from v3 to v6, the version CI uses, because v3's Node runtime is too old for GitHub's runners.Before merging, castore needs a workload identity on hex.pm for
elixir-mint/castore, workflowpublish.ymland environmentrelease, and this repository needs thereleaseenvironment. Merging publishes nothing, because 1.0.21 is already on Hex, so the first exchange runs when the next certificate update bumpsVERSION. After that publish, theHEX_API_KEYsecret and its key on hex.pm can be removed.