Use npm trusted publishing for package releases

[mchatlas-hellosign]

Summary

• replace the separate beta and production workflows with one production release workflow
• run only for pushes to main that change package.json, with an additional event/ref guard on every job
• preserve the existing Node 16 install, build, test, version validation, and package steps
• publish the packed artifact from Node 24/npm 11.19.1 using npm trusted publishing and no npm token
• create the GitHub Release and upload both bundles to the production CDN only after npm publishing succeeds
• remove pull-request beta publishing and non-production CDN uploads

Workflow structure

1. build validates and packages the release on Node 16, then uploads a one-day workflow artifact.
2. publish downloads that artifact and publishes it through npm OIDC.
3. release runs only after npm succeeds, creates the GitHub Release, and deploys the same build artifacts to the production CDN through the existing AWS OIDC role.

The workflow has no GitHub environment dependency. Publishing is gated in code by the main push trigger, the package.json path filter, and job-level event/ref conditions.

Validation

• npm trusted publishing was proven end to end by staging 2.12.3-oidc-test.1.2 from this workflow with no npm token
• the isolated Node 16 build passed all 8 test suites and 76 tests and produced the expected six-file package
• Node 24 with npm 11.19.1 supports the required trusted-publishing commands
• actionlint v1.7.12 passed on the consolidated workflow
• the final workflow YAML parses successfully and git diff --check passes

Release follow-up

• reject the staged 2.12.3-oidc-test.1.2 package after inspection
• npm's trusted publisher must allow direct npm publish
• npm, main, and the latest GitHub Release are 2.12.3; an orphaned v2.12.4 tag already exists outside main
• after this pipeline PR merges, prepare a separate 2.12.4 version PR and replace the old tag immediately before merging that release

The workflow filename remains github-actions.yml, matching npm's trusted-publisher configuration.

[ericbecking]

Hey folks. Can the admin for this repo remove the github user ericbecking from notifications? I no longer work for dropbox so it's kind of weird to be receiving these emails.

…

On Mon, Sep 14, 2026 at 3:53 AM mchatlas-hellosign ***@***.***> wrote: Merged #190 <#190> into main. — Reply to this email directly, view it on GitHub <#190?email_source=notifications&email_token=AADYHMMJGSIQLVB7BFFOCJD5O7EZLA5CNFSNUABQM5UWIORPF5TWS5BNNB2WEL2JONZXKZKFOZSW45CON52GSZTJMNQXI2LPNYXTGMJQHE2DKNRZHA4DJJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#event-31094569884>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADYHMPSRBXHKVLSL3MSKMT5O7EZLAVCNFSNUABEKJSXA33TNF2G64TZHM2DIMJZGQZTEOB3JFZXG5LFHM2TIMRUHA2DCNZTGGQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AADYHMIFEBFA7UAIZCT2NAD5O7EZLA5CNFSNUABQM5UWIORPF5TWS5BNNB2WEL2JONZXKZKFOZSW45CON52GSZTJMNQXI2LPNYXTGMJQHE2DKNRZHA4DJJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/AADYHMOXBXFEUW3IPAHP6UD5O7EZLA5CNFSNUABQM5UWIORPF5TWS5BNNB2WEL2JONZXKZKFOZSW45CON52GSZTJMNQXI2LPNYXTGMJQHE2DKNRZHA4DJJTSMVQXG33OVJZXKYTTMNZGSYTFMSSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.*** com>