From 0186fea1a268988bbca16cec53e95deea06dd27b Mon Sep 17 00:00:00 2001
From: raj pandey <raj.pandey@contentstack.com>
Date: Wed, 2 Sep 2026 14:54:04 +0530
Subject: [PATCH 1/2] =?UTF-8?q?fix(ci):=20harden=20release=20workflows=20?=
 =?UTF-8?q?=E2=80=94=20Node=2024,=20permissions,=20registry-url?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add `permissions: contents: read / id-token: write` to both release
  jobs; id-token:write is required for npm provenance (SLSA attestation)
- Upgrade node-version from 22.x to 24 to match the org-wide publish
  standard and stay ahead of Node 22 LTS EOL
- Add `registry-url: https://registry.npmjs.org/` to setup-node so the
  runner writes a proper .npmrc with NODE_AUTH_TOKEN wired up for any
  plain `npm` calls in the job

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/release-production-core.yml             | 6 +++++-
 .github/workflows/release-production-platform-plugins.yml | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-production-core.yml b/.github/workflows/release-production-core.yml
index e6e45eeb15..43d84b19fa 100644
--- a/.github/workflows/release-production-core.yml
+++ b/.github/workflows/release-production-core.yml
@@ -6,6 +6,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -13,7 +16,8 @@ jobs:
           version: 10.28.0
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24'
+          registry-url: https://registry.npmjs.org/
 
       - name: Enable Corepack
         run: corepack enable
diff --git a/.github/workflows/release-production-platform-plugins.yml b/.github/workflows/release-production-platform-plugins.yml
index 69a180c3fb..cfd7409164 100644
--- a/.github/workflows/release-production-platform-plugins.yml
+++ b/.github/workflows/release-production-platform-plugins.yml
@@ -6,6 +6,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -13,7 +16,8 @@ jobs:
           version: 10.28.0
       - uses: actions/setup-node@v4
         with:
-          node-version: '22.x'
+          node-version: '24'
+          registry-url: https://registry.npmjs.org/
 
       - name: Enable Corepack
         run: corepack enable

From 6f259169cfe470a9f06d1c2bc86fddd685f68982 Mon Sep 17 00:00:00 2001
From: raj pandey <raj.pandey@contentstack.com>
Date: Wed, 2 Sep 2026 15:03:04 +0530
Subject: [PATCH 2/2] fix(ci): add npm provenance and update npm before
 publishing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add 'Update npm' step (npm install -g npm@latest) before publish in
  both release jobs — ensures npm supports --provenance (requires npm 9+)
- Add provenance: true to all JS-DevTools/npm-publish@v3 steps so the
  OIDC token granted by id-token:write is actually used to generate SLSA
  attestations on npmjs.com

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/release-production-core.yml             | 4 ++++
 .github/workflows/release-production-platform-plugins.yml | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/.github/workflows/release-production-core.yml b/.github/workflows/release-production-core.yml
index 43d84b19fa..37f1355048 100644
--- a/.github/workflows/release-production-core.yml
+++ b/.github/workflows/release-production-core.yml
@@ -41,6 +41,9 @@ jobs:
           filename: .github/config/release.json
           prefix: release
 
+      - name: Update npm
+        run: npm install -g npm@latest
+
       - name: Publishing core (Production)
         id: publish-core
         uses: JS-DevTools/npm-publish@v3
@@ -48,6 +51,7 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack/package.json
           tag: latest
+          provenance: true
 
       - name: Create Core Production Release
         id: create_release
diff --git a/.github/workflows/release-production-platform-plugins.yml b/.github/workflows/release-production-platform-plugins.yml
index cfd7409164..d4b02588fa 100644
--- a/.github/workflows/release-production-platform-plugins.yml
+++ b/.github/workflows/release-production-platform-plugins.yml
@@ -41,6 +41,9 @@ jobs:
           filename: .github/config/release.json
           prefix: release
 
+      - name: Update npm
+        run: npm install -g npm@latest
+
       # Utilities
       - name: Publishing utilities (Production)
         uses: JS-DevTools/npm-publish@v3
@@ -48,6 +51,7 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-utilities/package.json
           tag: latest
+          provenance: true
 
       # Command
       - name: Publishing command (Production)
@@ -56,6 +60,7 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-command/package.json
           tag: latest
+          provenance: true
 
       # Config
       - name: Publishing config (Production)
@@ -64,6 +69,7 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-config/package.json
           tag: latest
+          provenance: true
 
       # Auth
       - name: Publishing auth (Production)
@@ -72,3 +78,4 @@ jobs:
           token: ${{ secrets.NPM_TOKEN }}
           package: ./packages/contentstack-auth/package.json
           tag: latest
+          provenance: true