Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: intercom/intercom-node
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: intercom/intercom-node
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: patoc/oidc-staged-publishing
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 2 commits
  • 2 files changed
  • 2 contributors

Commits on Jun 12, 2026

  1. Add staged OIDC publish workflow 

    Replace token-based npm publishing with OIDC trusted publishing + npm
staged publishing: CI authenticates with a short-lived OIDC token (no
stored npm token) and stages the release; a maintainer promotes it from
the npm staging area with 2FA.

The verify job asserts the Release tag matches package.json and refuses
releases not reachable from the default branch. Listed in .fernignore so
it is not overwritten by code generation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    @patocallaghan @claude
    patocallaghan and claude committed Jun 12, 2026
    Configuration menu
    Copy the full SHA
    39b37d3 View commit details
    Browse the repository at this point in the history

Commits on Jun 17, 2026

  1. Pin stage-publish to the ancestry-checked SHA (close TOCTOU window) 

    verify now outputs the validated $GITHUB_SHA; stage-publish checks out that
exact SHA instead of re-resolving the mutable release tag, so the commit that
is published is provably the one the branch-ancestry guard approved. Mirrors
the hardening already in intercom-react-native.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    @patocallaghan @claude
    patocallaghan and claude committed Jun 17, 2026
    Configuration menu
    Copy the full SHA
    ea92a5d View commit details
    Browse the repository at this point in the history
Loading