From 13c58a98fdd44ef9e7d857675bc4c64702e3a05e Mon Sep 17 00:00:00 2001
From: Matt Hillsdon <matt.hillsdon@microbit.org>
Date: Tue, 8 Sep 2026 16:15:46 +0000
Subject: [PATCH 1/2] Publish to npm via trusted publishing

Replaces the NPM_TOKEN secret with OIDC, following makecode-embed. The
build job packs the routed workspace's tarball and a separate publish
job, with no checkout and the only id-token permission, stages it to npm
from the npm-publish environment. npm stage is unaware of workspaces,
but publishing the tarball from npm pack -w sidesteps that. npm pack now
runs on every build (for @microbit/ui on branches) so packaging problems
fail a branch build rather than a release.
---
 .github/workflows/build.yml | 33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ca53125..88851d3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,7 +19,6 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: "24.x"
-          registry-url: "https://registry.npmjs.org"
           cache: npm
       - run: npm install -g npm@${{ env.NPM_VERSION }}
       - run: npm ci
@@ -50,10 +49,14 @@ jobs:
         with:
           working-directory: packages/${{ steps.route.outputs.package }}
       - run: npm run ci
-      - run: npm publish -w @microbit/${{ steps.route.outputs.package }} --allow-directory=all
-        if: github.event_name == 'release' && github.event.action == 'created'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm pack -w @microbit/${{ steps.route.outputs.package }}
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: github.event_name == 'release'
+        with:
+          name: npm-tarball
+          path: '*.tgz'
+          if-no-files-found: error
+          retention-days: 1
       # On main, hand the Storybook this run just built and checked to the
       # deploy job below. Releases are excluded naturally: their ref is a tag.
       - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
@@ -62,6 +65,26 @@ jobs:
         if: github.ref == 'refs/heads/main' && github.event_name != 'release'
         with:
           path: apps/storybook/storybook-static
+
+  publish:
+    needs: build
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: npm-tarball
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '24.x'
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm install -g npm@${{ env.NPM_VERSION }}
+      - run: npm stage publish --allow-file=all ./*.tgz
+
   deploy-storybook:
     needs: build
     if: github.ref == 'refs/heads/main' && github.event_name != 'release'

From cb8f73b40b253cff97226e18d98d4833673aaeb9 Mon Sep 17 00:00:00 2001
From: Matt Hillsdon <matt.hillsdon@microbit.org>
Date: Wed, 9 Sep 2026 12:30:06 +0000
Subject: [PATCH 2/2] Format workflow with Prettier

---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 88851d3..57e969d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,7 +54,7 @@ jobs:
         if: github.event_name == 'release'
         with:
           name: npm-tarball
-          path: '*.tgz'
+          path: "*.tgz"
           if-no-files-found: error
           retention-days: 1
       # On main, hand the Storybook this run just built and checked to the
@@ -80,8 +80,8 @@ jobs:
           name: npm-tarball
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
-          node-version: '24.x'
-          registry-url: 'https://registry.npmjs.org'
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
       - run: npm install -g npm@${{ env.NPM_VERSION }}
       - run: npm stage publish --allow-file=all ./*.tgz