From 5d95f2f161cbd8d2ba9bc344d636ccb0ab866b40 Mon Sep 17 00:00:00 2001 From: jmeredithg Date: Tue, 14 Jul 2026 14:27:38 -0700 Subject: [PATCH 1/5] Authenticate npm publish via Cloudsmith OIDC --- .github/workflows/publish.yaml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 63d08d754..9e4fb5555 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -21,10 +21,17 @@ jobs: steps: - uses: actions/checkout@v6 + - name: Authenticate with Cloudsmith via OIDC + uses: cloudsmith-io/cloudsmith-cli-action@v2 + with: + oidc-namespace: "gusto" + oidc-service-slug: "gusto-cloudsmith-write-svc-01" + oidc-auth-only: "true" + - uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' - registry-url: 'https://registry.npmjs.org' + registry-url: 'https://cloudsmith.io/gusto/gusto' - name: Restore node_modules cache id: cache-node-modules @@ -81,7 +88,7 @@ jobs: - name: Publish to NPM run: npm publish --access public env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }} - name: Read SDK version id: version From c3ee167641d2d0ba10b66f00596dceb38f6eac70 Mon Sep 17 00:00:00 2001 From: jmeredithg Date: Tue, 14 Jul 2026 14:28:07 -0700 Subject: [PATCH 2/5] Authenticate npm RC publish via Cloudsmith OIDC --- .github/workflows/publish-rc.yaml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-rc.yaml b/.github/workflows/publish-rc.yaml index f2e23fe3c..1ecce154f 100644 --- a/.github/workflows/publish-rc.yaml +++ b/.github/workflows/publish-rc.yaml @@ -60,10 +60,17 @@ jobs: exit 1 fi + - name: Authenticate with Cloudsmith via OIDC + uses: cloudsmith-io/cloudsmith-cli-action@v2 + with: + oidc-namespace: "gusto" + oidc-service-slug: "gusto-cloudsmith-write-svc-01" + oidc-auth-only: "true" + - uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' - registry-url: 'https://registry.npmjs.org' + registry-url: 'https://cloudsmith.io/gusto/gusto' - name: Restore node_modules cache id: cache-node-modules @@ -169,7 +176,7 @@ jobs: - name: Publish RC version run: npm publish --access public --tag rc env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }} - name: Output published version run: | From 95e69e7591c211a8d26f3d053e876ef77b53a8a5 Mon Sep 17 00:00:00 2001 From: jmeredithg Date: Tue, 14 Jul 2026 14:28:25 -0700 Subject: [PATCH 3/5] Authenticate npm unpublish via Cloudsmith OIDC --- .github/workflows/unpublish.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/unpublish.yaml b/.github/workflows/unpublish.yaml index 1c640eaf5..3de5ea2fd 100644 --- a/.github/workflows/unpublish.yaml +++ b/.github/workflows/unpublish.yaml @@ -13,10 +13,16 @@ jobs: id-token: write steps: - uses: actions/checkout@v6 + - name: Authenticate with Cloudsmith via OIDC + uses: cloudsmith-io/cloudsmith-cli-action@v2 + with: + oidc-namespace: "gusto" + oidc-service-slug: "gusto-cloudsmith-write-svc-01" + oidc-auth-only: "true" - uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' - registry-url: 'https://registry.npmjs.org' + registry-url: 'https://cloudsmith.io/gusto/gusto' - run: npm unpublish @gusto/embedded-react-sdk@${{ github.event.inputs.version }} env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }} From e842d70d37a2dc32e5b0d6ea0954aad1dc743853 Mon Sep 17 00:00:00 2001 From: jmeredithg Date: Tue, 14 Jul 2026 14:28:55 -0700 Subject: [PATCH 4/5] Authenticate npm RC unpublish via Cloudsmith OIDC --- .github/workflows/unpublish-rc.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/unpublish-rc.yaml b/.github/workflows/unpublish-rc.yaml index 8a71dc71b..d57c84ac1 100644 --- a/.github/workflows/unpublish-rc.yaml +++ b/.github/workflows/unpublish-rc.yaml @@ -31,10 +31,16 @@ jobs: id-token: write steps: - uses: actions/checkout@v6 + - name: Authenticate with Cloudsmith via OIDC + uses: cloudsmith-io/cloudsmith-cli-action@v2 + with: + oidc-namespace: "gusto" + oidc-service-slug: "gusto-cloudsmith-write-svc-01" + oidc-auth-only: "true" - uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' - registry-url: 'https://registry.npmjs.org' + registry-url: 'https://cloudsmith.io/gusto/gusto' - name: Validate confirmation run: | @@ -176,7 +182,7 @@ jobs: fi fi env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }} - name: Summary run: | From a00a5aedd3caddc3240b621d742df50f76b0fd5d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 14 Jul 2026 21:59:42 +0000 Subject: [PATCH 5/5] chore: fix prettier formatting for workflow files --- .github/workflows/publish-rc.yaml | 6 +++--- .github/workflows/publish.yaml | 6 +++--- .github/workflows/unpublish-rc.yaml | 6 +++--- .github/workflows/unpublish.yaml | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/publish-rc.yaml b/.github/workflows/publish-rc.yaml index 1ecce154f..808ca0588 100644 --- a/.github/workflows/publish-rc.yaml +++ b/.github/workflows/publish-rc.yaml @@ -63,9 +63,9 @@ jobs: - name: Authenticate with Cloudsmith via OIDC uses: cloudsmith-io/cloudsmith-cli-action@v2 with: - oidc-namespace: "gusto" - oidc-service-slug: "gusto-cloudsmith-write-svc-01" - oidc-auth-only: "true" + oidc-namespace: 'gusto' + oidc-service-slug: 'gusto-cloudsmith-write-svc-01' + oidc-auth-only: 'true' - uses: actions/setup-node@v6 with: diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 9e4fb5555..2d4c1986d 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -24,9 +24,9 @@ jobs: - name: Authenticate with Cloudsmith via OIDC uses: cloudsmith-io/cloudsmith-cli-action@v2 with: - oidc-namespace: "gusto" - oidc-service-slug: "gusto-cloudsmith-write-svc-01" - oidc-auth-only: "true" + oidc-namespace: 'gusto' + oidc-service-slug: 'gusto-cloudsmith-write-svc-01' + oidc-auth-only: 'true' - uses: actions/setup-node@v6 with: diff --git a/.github/workflows/unpublish-rc.yaml b/.github/workflows/unpublish-rc.yaml index d57c84ac1..4cbaf2581 100644 --- a/.github/workflows/unpublish-rc.yaml +++ b/.github/workflows/unpublish-rc.yaml @@ -34,9 +34,9 @@ jobs: - name: Authenticate with Cloudsmith via OIDC uses: cloudsmith-io/cloudsmith-cli-action@v2 with: - oidc-namespace: "gusto" - oidc-service-slug: "gusto-cloudsmith-write-svc-01" - oidc-auth-only: "true" + oidc-namespace: 'gusto' + oidc-service-slug: 'gusto-cloudsmith-write-svc-01' + oidc-auth-only: 'true' - uses: actions/setup-node@v6 with: node-version-file: '.nvmrc' diff --git a/.github/workflows/unpublish.yaml b/.github/workflows/unpublish.yaml index 3de5ea2fd..49cb5f795 100644 --- a/.github/workflows/unpublish.yaml +++ b/.github/workflows/unpublish.yaml @@ -16,9 +16,9 @@ jobs: - name: Authenticate with Cloudsmith via OIDC uses: cloudsmith-io/cloudsmith-cli-action@v2 with: - oidc-namespace: "gusto" - oidc-service-slug: "gusto-cloudsmith-write-svc-01" - oidc-auth-only: "true" + oidc-namespace: 'gusto' + oidc-service-slug: 'gusto-cloudsmith-write-svc-01' + oidc-auth-only: 'true' - uses: actions/setup-node@v6 with: node-version-file: '.nvmrc'