From a29d00112c6a661043171c74ab373cfa41f9a959 Mon Sep 17 00:00:00 2001 From: Tejas Kashinath Date: Fri, 18 Sep 2026 15:57:36 -0400 Subject: [PATCH] ci(release): publish from the CodeBuild runner without provenance The org's shared ubuntu-latest pool never picked up the publish job. Trusted publishing works from the CodeBuild runner, provenance is only signed on GitHub-hosted runners, so the flag goes until a hosted runner is available. --- .github/workflows/release-main-and-preview.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-main-and-preview.yml b/.github/workflows/release-main-and-preview.yml index 5998003a1..4627c116c 100644 --- a/.github/workflows/release-main-and-preview.yml +++ b/.github/workflows/release-main-and-preview.yml @@ -14,7 +14,7 @@ on: jobs: check-release: if: "!github.event.deleted" - runs-on: ubuntu-latest + runs-on: ["codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }}", "verify-linux"] permissions: pull-requests: read outputs: @@ -52,8 +52,9 @@ jobs: publish: needs: verify - # npm provenance is only issued from GitHub-hosted runners. - runs-on: ubuntu-latest + # Trusted publishing works from this runner, provenance would not: npm only signs + # provenance on GitHub-hosted runners, and the org's hosted pool never picks this repo up. + runs-on: ["codebuild-agentcore-e2e-${{ github.run_id }}-${{ github.run_attempt }}", "verify-linux"] environment: name: npm-publish url: https://www.npmjs.com/package/@aws/agentcore @@ -112,7 +113,7 @@ jobs: if npm view "@aws/agentcore@$VERSION" version >/dev/null 2>&1; then echo "@aws/agentcore@$VERSION is already on npm, skipping publish" else - npm publish "$TARBALL" --provenance --access public --tag "$DIST_TAG" + npm publish "$TARBALL" --access public --tag "$DIST_TAG" fi - env: