Publish with Depot workflows

1. Trust the Depot identity

1. Copy the Depot organization ID from the Depot URL or OIDC identity. It looks like nnkbz93qn7.
2. Open the destination project's CI / OIDC settings.
3. Choose Depot CI, enter the repository or organization, and enter the Depot organization ID.
4. Choose Pull & Publish. Keep the pull-only review grant separate when possible.
5. Run this workflow only from a protected branch or tag. Push access is never issued to pull-request events.

2. Add the workflow

name: Publish adversary

on:
  push:
    tags: ["v*"]

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: depot-ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Publish adversary
        uses: doomerlabs/actions/push@v1
        with:
          path: .
          auth-mode: oidc
          registry-namespace: your-project-slug
          repository-name: security-reviewer
          push-latest: true

• The OIDC grant must match the repository identity and the Depot organization ID.
• id-token: write enables the short-lived identity exchange; no registry token is stored in Depot.
• The action validates, builds, packages, and pushes the version inferred from the adversary project.
• push-latest is optional. Remove it when consumers should pin explicit versions.

Service-account fallback

If Depot OIDC is unavailable, create a dedicated service account with registry:pull and registry:push. Add it to Depot secrets as ADVERSARY_PUBLISH_TOKEN and replace the publish step:

- name: Publish adversary
  uses: doomerlabs/actions/push@v1
  with:
    path: .
    auth-mode: token
    token: ${{ secrets.ADVERSARY_PUBLISH_TOKEN }}
    registry-namespace: your-project-slug
    repository-name: security-reviewer
    push-latest: true

Use this token only in the trusted publishing workflow, rotate it regularly, and never expose it to pull-request jobs.