Publish with GitHub Actions

1. Trust the release repository

1. Open the destination project's CI / OIDC settings.
2. Choose GitHub Actions and add the exact owner/repository. Add the numeric repository or organization ID for stronger rename protection.
3. Choose Pull & Publish. A pull-only review grant cannot publish.
4. Protect the release branch or tag in GitHub. Push access is never issued to pull-request events.

2. Add the workflow

name: Publish adversary

on:
  push:
    tags: ["v*"]

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Publish adversary
        uses: doomerlabs/actions/push@v1
        with:
          path: .
          auth-mode: oidc
          registry-namespace: your-project-slug
          repository-name: security-reviewer
          push-latest: true

• id-token: write lets the job request a short-lived GitHub OIDC identity; it does not grant repository write access.
• The action validates, builds, packages, and pushes the version inferred from the adversary project.
• repository-name is the package name inside the project namespace. Keep it stable across releases.
• push-latest also advances the mutable latest tag. Remove it when consumers should use explicit versions only.

Service-account fallback

If OIDC is unavailable, create a dedicated service account with registry:pull and registry:push. Save it as the protected GitHub secret ADVERSARY_PUBLISH_TOKEN and replace the publish step:

- name: Publish adversary
  uses: doomerlabs/actions/push@v1
  with:
    path: .
    auth-mode: token
    token: ${{ secrets.ADVERSARY_PUBLISH_TOKEN }}
    registry-namespace: your-project-slug
    repository-name: security-reviewer
    push-latest: true

Do not expose this token to pull-request jobs. Prefer a GitHub environment with required reviewers when releases need manual approval.