fix for trusted publishing

Author: whoiskatrin

.github/workflows/release.yml

@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -144,6 +148,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
+      id-token: write # Required for trusted publishing
       contents: write
       pull-requests: write
 
@@ -155,12 +160,16 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
 
+      - name: Upgrade npm for OIDC trusted publishing
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
@@ -184,7 +193,9 @@ jobs:
           target: default
           platforms: linux/amd64
           push: true
-          tags: cloudflare/sandbox:${{ needs.unit-tests.outputs.version }}
+          tags: |
+            cloudflare/sandbox:${{ needs.unit-tests.outputs.version }}
+            cloudflare/sandbox:latest
           cache-from: type=gha,scope=release-default
           cache-to: type=gha,mode=max,scope=release-default
           build-args: |
@@ -198,7 +209,9 @@ jobs:
           target: python
           platforms: linux/amd64
           push: true
-          tags: cloudflare/sandbox:${{ needs.unit-tests.outputs.version }}-python
+          tags: |
+            cloudflare/sandbox:${{ needs.unit-tests.outputs.version }}-python
+            cloudflare/sandbox:latest-python
           cache-from: type=gha,scope=release-python
           cache-to: type=gha,mode=max,scope=release-python
           build-args: |
@@ -211,5 +224,58 @@ jobs:
           publish: npx tsx .github/changeset-publish.ts
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
-          NPM_PUBLISH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
+
+      # Beta release - publishes on every push to main
+      - name: Modify package.json version for beta
+        run: npx tsx .github/version-script.ts
+
+      - name: Resolve workspace dependencies
+        run: npx tsx .github/resolve-workspace-versions.ts
+
+      - name: Rebuild packages for beta
+        run: npm run build
+
+      - name: Get beta version
+        id: beta-version
+        run: |
+          VERSION=$(node -p "require('./packages/sandbox/package.json').version")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Build and push Docker image (default) - beta
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: packages/sandbox/Dockerfile
+          target: default
+          platforms: linux/amd64
+          push: true
+          tags: |
+            cloudflare/sandbox:${{ steps.beta-version.outputs.version }}
+            cloudflare/sandbox:beta
+          cache-from: type=gha,scope=beta-default
+          cache-to: type=gha,mode=max,scope=beta-default
+          build-args: |
+            SANDBOX_VERSION=${{ steps.beta-version.outputs.version }}
+
+      - name: Build and push Docker image (python) - beta
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: packages/sandbox/Dockerfile
+          target: python
+          platforms: linux/amd64
+          push: true
+          tags: |
+            cloudflare/sandbox:${{ steps.beta-version.outputs.version }}-python
+            cloudflare/sandbox:beta-python
+          cache-from: type=gha,scope=beta-python
+          cache-to: type=gha,mode=max,scope=beta-python
+          build-args: |
+            SANDBOX_VERSION=${{ steps.beta-version.outputs.version }}
+
+      - name: Publish npm package (beta)
+        run: npm publish --tag beta
+        env:
+          NPM_CONFIG_PROVENANCE: true
+        working-directory: packages/sandbox