From 73a5faebf4c4f01cda80879408465425bb516f32 Mon Sep 17 00:00:00 2001
From: Emma Hamilton <git@emmas.town>
Date: Mon, 23 Mar 2026 13:58:08 +1000
Subject: [PATCH] OIDC publishing

---
 .github/workflows/publish.yml          | 32 ++++++++++++++----
 .github/workflows/publish_snapshot.yml | 45 --------------------------
 2 files changed, 26 insertions(+), 51 deletions(-)
 delete mode 100644 .github/workflows/publish_snapshot.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 886571d96..734131d3b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -2,6 +2,14 @@ name: Publish
 
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'The npm tag to publish to'
+        required: true
+        type: choice
+        options:
+          - latest
+          - test
 
 permissions:
   contents: write
@@ -11,7 +19,8 @@ jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
-    environment: release
+    timeout-minutes: 10
+    environment: Release
     steps:
       - uses: actions/checkout@main
         with:
@@ -27,10 +36,21 @@ jobs:
           git config --global user.name 'Thinkmill Release Bot'
           git config --global user.email 'automation+github@thinkmill.com.au'
 
-      - name: npm publish, git tag
-        run: pnpm changeset publish
+      - name: version packages
+        if: inputs.tag != 'latest'
+        run: |
+          pnpm changeset version --snapshot ${{ inputs.tag }}
+          git commit -a -m 'rc'
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: npm publish, git tag
+        run: pnpm changeset publish --tag ${{ inputs.tag }}
+
+      # reset, then we have a tagged dangling commit
+      - name: git push
+        if: inputs.tag != 'latest'
+        run: |
+          git reset HEAD~1 --hard
 
-      - run: git push origin --follow-tags
+      - run: git push origin --tags
diff --git a/.github/workflows/publish_snapshot.yml b/.github/workflows/publish_snapshot.yml
deleted file mode 100644
index 48ded681f..000000000
--- a/.github/workflows/publish_snapshot.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: Publish (Snapshot)
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  id-token: write
-
-jobs:
-  publish_snapshot:
-    name: Publish (Snapshot)
-    runs-on: ubuntu-latest
-    environment: release
-    steps:
-      - uses: actions/checkout@main
-        with:
-          persist-credentials: true # needed for git push
-
-      - uses: ./.github/actions/setup-deps
-
-      - name: version packages
-        run: pnpm changeset version --snapshot ${{ inputs.tag }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: git commit
-        run: |
-          git config --global user.name 'Thinkmill Release Bot'
-          git config --global user.email 'automation+github@thinkmill.com.au'
-          git commit -a -m 'rc'
-
-      - run: pnpm build:packages
-
-      - name: npm publish, git tag
-        run: pnpm changeset publish --tag test
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
-
-      # reset, then push the dangling commit
-      - name: git push
-        run: |
-          git reset HEAD~1 --hard
-          git push origin --tags