mirror of
https://github.com/cline/cline.git
synced 2026-09-01 15:11:04 +08:00
Saoud Rizwan
62c57a0ccd
The publish job ran under the shared `Publish` GitHub environment, whose required reviewers turned every @cline/ui release into a two-person ceremony. Nothing in the job reads secrets from that environment — it authenticates to npm purely over OIDC trusted publishing — so the environment bought us an approval prompt and nothing else. sdk-publish and cli-publish already publish unattended the same way. The npm trusted publisher for @cline/ui was registered with `environment: Publish`, which pins the OIDC token's environment claim, so it has been re-registered without it (same repo, workflow file, and permissions). That change is already live; landing this without it would have broken publishing. Access is still gated by workflow_dispatch (write access required), the `refs/heads/main` ref check, and the typed `publish` confirmation.