From 5db082c73813cae304ebdc31d85a390a4e6122ca Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 4 Oct 2026 14:10:31 +0300 Subject: [PATCH 1/2] chore(ci): adopt putio-ci credential names --- .github/workflows/ci.yml | 4 ++-- docs/DISTRIBUTION.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 103a7bc..1c5482a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -47,6 +47,6 @@ jobs: permissions: contents: read id-token: write - uses: putdotio/.github/.github/workflows/frontend-release-npm.yml@8240b79dee9e0933c757bca249c82daa698d9c47 # v1.0.2 + uses: putdotio/.github/.github/workflows/frontend-release-npm.yml@aebc5c2313cce5d667477d1a48d30a6f2eb4bc31 # putio-ci credential rename secrets: - PUTIO_RELEASE_BOT_PRIVATE_KEY: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }} + PUTIO_CI_APP_PRIVATE_KEY: ${{ secrets.PUTIO_CI_APP_PRIVATE_KEY }} diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index fcf24de..d200161 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -16,7 +16,7 @@ Release expectations: - npm package: `@putdotio/vref`, public access - npm Trusted Publishing through GitHub Actions OIDC for `putdotio/vref`, workflow `ci.yml`, Environment `release`, with provenance enabled in the release step - the `release` Environment has no deployment records and no human approval -- `putio-releaser` writes tags, GitHub releases, and `[skip ci]` version bump commits, so it needs write access to protected `main` and `v*` tags +- `putio-ci` writes tags, GitHub releases, and `[skip ci]` version bump commits, so it needs write access to protected `main` and `v*` tags ## Package Contents From 9737d4f7090a0c59a65bb3fb5b66a6bbaf47add5 Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 4 Oct 2026 14:15:19 +0300 Subject: [PATCH 2/2] docs: clarify reviewed release workflow pin --- docs/DISTRIBUTION.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index d200161..4de2d80 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -9,7 +9,7 @@ Merges to `main` are publishable. Links to files outside the tarball are absolute so they resolve for npm consumers. -The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a tagged commit; the semantic-release action and plugin pins live there. [`scan.yml`](https://github.com/putdotio/vref/blob/main/.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch. +The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a reviewed commit SHA; the semantic-release action and plugin pins live there. [`scan.yml`](https://github.com/putdotio/vref/blob/main/.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch. Release expectations: