Skip to content

ci: enable OIDC signing for ToolHive skill releases - #39

Merged
JAORMX merged 1 commit into
mainfrom
fix/release-skill-oidc
Sep 25, 2026
Merged

JAORMX merged 1 commit into
mainfrom
fix/release-skill-oidc

Conversation

@JAORMX

@JAORMX JAORMX commented Sep 25, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • grant only the ToolHive skill publishing job id-token: write
  • allow keyless OIDC signing required by thv skill push

Validation

  • actionlint .github/workflows/release.yml
  • DevOps and security review: least-privilege job-scoped permission; no static signing credential added.

The previous v0.0.9 GoReleaser release succeeded, while its ToolHive skill publication failed because the tag’s workflow lacked this permission. A subsequent tagged release is required to publish a signed artifact.

@JAORMX
JAORMX merged commit 2e1850a into main Sep 25, 2026
10 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant