jason810496 opened a new pull request, #71843: URL: https://github.com/apache/airflow/pull/71843
## Why Publishing the TypeScript SDK with a long-lived npm token would expose a reusable credential and would not establish verifiable build provenance. ## How - Require a manually dispatched, semver-matching `ts-sdk/<version>` tag. - Require approval through the protected `ts-sdk-npm` GitHub environment. - Publish from a GitHub-hosted runner through npm trusted publishing and OIDC. - Publish prereleases under `next` and stable versions under `latest`. - Configure public scoped-package access and document the required npm trusted-publisher setup. The actual publish step requires the `apache/airflow` GitHub environment and npm trusted-publisher configuration described in the documentation. --- ##### Was generative AI tooling used to co-author this PR? - [x] Yes, with help of Codex GPT-5 following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
