A GitHub Action to publish codemods to the Codemod registry using OIDC authentication.

• No secrets required: Uses GitHub Actions OIDC tokens for authentication
• Secure: No API keys to manage or rotate
• Simple: Just add the action to your workflow

Before using this action, you must configure a trusted publisher for your package:

1. Go to codemod.com and sign in
2. Navigate to API Keys in your dashboard
3. Under Trusted Publishers, click Add Trusted Publisher
4. Select your package and enter your GitHub repository details
5. (Optional) Add restrictions for workflow path, environment, or ref pattern

name: Publish Codemod
on:
  release:
    types: [published]

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Publish codemod
        uses: codemod/publish-action@v1

name: Publish Codemod
on:
  release:
    types: [published]

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: codemod/publish-action@v1

name: Publish Codemod
on:
  push:
    branches: [main]
    paths:
      - 'codemods/my-codemod/**'

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: codemod/publish-action@v1
        with:
          path: codemods/my-codemod

For additional security, you can use GitHub Environments:

name: Publish Codemod
on:
  release:
    types: [published]

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: production  # Requires environment approval
    steps:
      - uses: actions/checkout@v4
      - uses: codemod/publish-action@v1

Then configure the trusted publisher with environment: production restriction.

This action uses OpenID Connect (OIDC) to authenticate with the Codemod registry. When GitHub Actions runs your workflow, it can request a short-lived OIDC token that proves the workflow's identity. The Codemod registry verifies this token and checks it against your configured trusted publishers.

Benefits:

• No long-lived secrets to manage
• Tokens are short-lived (~5 minutes)
• Fine-grained control via trusted publisher restrictions
• Full audit trail of publishes

Make sure you've configured a trusted publisher for your package that matches:

• Repository owner (organization or username)
• Repository name
• Any configured restrictions (workflow path, environment, ref pattern)

Ensure your workflow has the required permissions:

permissions:
  id-token: write  # Required for OIDC token
  contents: read   # Required to checkout code

The OIDC token audience must match the registry URL. If using a custom registry, make sure the registry input matches your trusted publisher configuration.