Recover v1.3.1 release publishing (#133)

Signed-off-by: Sherif Mansour <13433538+kerberosmansour@users.noreply.github.com>

Author: kerberosmansour

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -62,7 +62,7 @@ body:
     attributes:
       label: Package version(s)
       description: Output of `pnpm list @hulumi/baseline @hulumi/policies @hulumi/drift @hulumi/k8s-baseline @hulumi/cloudflare-baseline @hulumi/platform-patterns @pulumi/aws @pulumi/pulumi @pulumi/kubernetes @pulumi/cloudflare`.
-      placeholder: e.g. `@hulumi/baseline 1.3.0`, `@pulumi/aws 7.27.0`, `@pulumi/pulumi 3.232.0`
+      placeholder: e.g. `@hulumi/baseline 1.3.1`, `@pulumi/aws 7.27.0`, `@pulumi/pulumi 3.232.0`
     validations:
       required: true
   - type: input

.github/attestations/README.md

@@ -8,17 +8,17 @@ covers verification via `gh attestation verify` and `cosign`.
 
 ```sh
 # Download the tarball
-pnpm pack @hulumi/baseline@1.3.0 --pack-destination .
+pnpm pack @hulumi/baseline@1.3.1 --pack-destination .
 
 # Verify the attestation
-gh attestation verify ./hulumi-baseline-1.3.0.tgz \
+gh attestation verify ./hulumi-baseline-1.3.1.tgz \
   --repo kerberosmansour/hulumi
 ```
 
 Expected output:
 
 ```
-Loaded digest sha256:<sha> for file://./hulumi-baseline-1.3.0.tgz
+Loaded digest sha256:<sha> for file://./hulumi-baseline-1.3.1.tgz
 Loaded 1 attestation from GitHub API
 ✓ Verification succeeded!
 
@@ -44,18 +44,18 @@ If you can't reach the GitHub API:
 
 ```sh
 # Download the tarball + the attestation
-pnpm pack @hulumi/baseline@1.3.0 --pack-destination .
-gh release download v1.3.0 \
+pnpm pack @hulumi/baseline@1.3.1 --pack-destination .
+gh release download v1.3.1 \
   --repo kerberosmansour/hulumi \
-  --pattern "hulumi-baseline-1.3.0.tgz.intoto.jsonl" \
+  --pattern "hulumi-baseline-1.3.1.tgz.intoto.jsonl" \
   --dir .
 
 # Verify with cosign (assumes a recent cosign + Sigstore root)
 cosign verify-blob \
-  --bundle ./hulumi-baseline-1.3.0.tgz.intoto.jsonl \
+  --bundle ./hulumi-baseline-1.3.1.tgz.intoto.jsonl \
   --certificate-identity-regexp '^https://github.com/kerberosmansour/hulumi/' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-  ./hulumi-baseline-1.3.0.tgz
+  ./hulumi-baseline-1.3.1.tgz
 ```
 
 ## What attestation guarantees

.github/workflows/release.yml

@@ -63,9 +63,14 @@ jobs:
           version: 9.12.0
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 20
+          node-version: 22.14.0
           cache: pnpm
           registry-url: https://registry.npmjs.org
+      - name: Use npm CLI with trusted publishing OIDC support
+        run: |
+          npm install -g npm@11.5.1
+          node --version
+          npm --version
       - run: pnpm install --frozen-lockfile
       - run: pnpm -r build
 
@@ -113,12 +118,9 @@ jobs:
       - name: npm publish (atomic — any failure aborts before subsequent publishes)
         run: |
           set -euo pipefail
-          pnpm --filter @hulumi/baseline publish --no-git-checks --provenance --access public
-          pnpm --filter @hulumi/policies publish --no-git-checks --provenance --access public
-          pnpm --filter @hulumi/drift publish --no-git-checks --provenance --access public
-          pnpm --filter @hulumi/k8s-baseline publish --no-git-checks --provenance --access public
-          pnpm --filter @hulumi/cloudflare-baseline publish --no-git-checks --provenance --access public
-          pnpm --filter @hulumi/platform-patterns publish --no-git-checks --provenance --access public
+          for pkg in baseline policies drift k8s-baseline cloudflare-baseline platform-patterns; do
+            (cd "packages/$pkg" && npm publish --provenance --access public)
+          done
 
       - name: Create GitHub release with SBOMs + tarballs
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3

CHANGELOG.md

@@ -5,21 +5,27 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.3.0] — 2026-05-15
+## [1.3.1] — 2026-05-15
 
 The Hulumi Edge Platform release. Atomic six-package publish:
-`@hulumi/baseline@1.3.0`, `@hulumi/policies@1.3.0`,
-`@hulumi/drift@1.3.0`, `@hulumi/k8s-baseline@1.3.0`, and first public
-publishes for `@hulumi/cloudflare-baseline@1.3.0` and
-`@hulumi/platform-patterns@1.3.0`. All six packages use the same SLSA
+`@hulumi/baseline@1.3.1`, `@hulumi/policies@1.3.1`,
+`@hulumi/drift@1.3.1`, `@hulumi/k8s-baseline@1.3.1`, and first public
+publishes for `@hulumi/cloudflare-baseline@1.3.1` and
+`@hulumi/platform-patterns@1.3.1`. All six packages use the same SLSA
 Build L3 + npm provenance release path.
 
+This patch supersedes the failed `v1.3.0` tag attempt. That workflow completed
+preflight, tarball generation, SBOM generation, and provenance attestation, but
+stopped before any npm package was published because tokenless npm trusted
+publishing ran under Node 20 / npm 10. `v1.3.1` keeps the same product changes
+and uses the trusted-publishing-compatible release runtime.
+
 ### Added
 
-- **`@hulumi/cloudflare-baseline@1.3.0`** — first release of Cloudflare
+- **`@hulumi/cloudflare-baseline@1.3.1`** — first release of Cloudflare
   edge primitives: `ZoneFoundation`, `PublicHostname`, `EdgeWafBaseline`,
   `BotProtectionBaseline`, and `ProtectedAdminHostname`.
-- **`@hulumi/platform-patterns@1.3.0`** — first release of
+- **`@hulumi/platform-patterns@1.3.1`** — first release of
   cross-provider patterns: `CloudflareOriginIngress`,
   `GitHubAwsOidcDeploymentRole`, `DeploymentRepositoryFoundation`, and
   `BuildProvenanceFoundation`.
@@ -28,7 +34,7 @@ Build L3 + npm provenance release path.
 - **Edge smoke and integration lanes**: `examples/edge-platform-smoke/`,
   Cloudflare/platform integration tests that skip without real credentials,
   and CI coverage for the new package pair.
-- **Release advisory preparation**: `docs/release/v1.3.0-security-advisories.md`
+- **Release advisory preparation**: `docs/release/v1.3.1-security-advisories.md`
   tracks the GHSA registrations to publish after the npm packages are live.
 
 ### Security
@@ -70,6 +76,9 @@ Build L3 + npm provenance release path.
 
 - Release and CI workflows expand from four to six packages for pack,
   SBOM, attestation, dry-run, and npm publish steps.
+- Release publishing now runs the npm publish phase on Node 22.14.0 with npm
+  11.5.1 so npm trusted publishing can exchange the GitHub OIDC token without a
+  long-lived `NPM_TOKEN`.
 - `release-readiness.test.ts` now enforces the six-package atomic version
   invariant, per-package README/LICENSE requirements, and the v1.3 changelog
   entry.

README.md

@@ -1,6 +1,6 @@
 # Hulumi
 
-> Hardened-by-default AWS, GitHub, Kubernetes, and Cloudflare edge infrastructure-as-code for Pulumi. Apache-2.0. v1.3.0.
+> Hardened-by-default AWS, GitHub, Kubernetes, and Cloudflare edge infrastructure-as-code for Pulumi. Apache-2.0. v1.3.1.
 
 ## What is Hulumi?
 
@@ -42,7 +42,7 @@ The docs are organised by what you're trying to do. The full index lives at [doc
 | Want to hack on Hulumi itself                                      | [Development guide](./docs/development.md)                          |
 | Hit a recurring gotcha and want a quick answer                     | [FAQ](./docs/faq.md)                                                |
 
-## What's in the box (v1.3.0)
+## What's in the box (v1.3.1)
 
 | Package                                  | What it gives you                                                                                                                                                                                                                                                                                                             |
 | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

SECURITY.md

@@ -112,17 +112,17 @@ Every Hulumi tarball published from v1.0.0 carries an
 
 ```sh
 # Download the tarball
-pnpm pack @hulumi/baseline@1.3.0 --pack-destination .
+pnpm pack @hulumi/baseline@1.3.1 --pack-destination .
 
 # Verify the attestation chain
-gh attestation verify ./hulumi-baseline-1.3.0.tgz \
+gh attestation verify ./hulumi-baseline-1.3.1.tgz \
   --repo kerberosmansour/hulumi
 ```
 
 Expected output: `✓ Verification succeeded` plus the build's commit SHA +
-workflow run URL. Repeat for `@hulumi/policies@1.3.0`, `@hulumi/drift@1.3.0`,
-`@hulumi/k8s-baseline@1.3.0`, `@hulumi/cloudflare-baseline@1.3.0`, and
-`@hulumi/platform-patterns@1.3.0`. The
+workflow run URL. Repeat for `@hulumi/policies@1.3.1`, `@hulumi/drift@1.3.1`,
+`@hulumi/k8s-baseline@1.3.1`, `@hulumi/cloudflare-baseline@1.3.1`, and
+`@hulumi/platform-patterns@1.3.1`. The
 [`.github/attestations/README.md`](./.github/attestations/README.md) covers
 both `gh attestation verify` and `cosign` verification paths.
 
@@ -133,7 +133,7 @@ Advisory link above.
 ## Pulumi cooling-off policy
 
 Hulumi's own releases carry SLSA Build L3 provenance. `@pulumi/*` transitive
-dependencies do not carry SLSA attestations as of v1.3.0. Our compensating
+dependencies do not carry SLSA attestations as of v1.3.1. Our compensating
 controls:
 
 1. **Exact-version-pinning with integrity hashes**: every `@pulumi/*` dep is
@@ -144,7 +144,7 @@ controls:
    `@aws-sdk/credential-providers`, `p-timeout`, `simple-git`) and
    `@hulumi/k8s-baseline`'s `@aws-sdk/client-secrets-manager`, plus
    `@pulumi/github` and `@pulumi/cloudflare` for the GitHub and edge
-   surfaces — 13 pinned packages total at v1.3.0.
+   surfaces — 13 pinned packages total at v1.3.1.
 2. **72h cooling-off for minor/major bumps + 24h for patches**:
    [`.github/workflows/pulumi-cooling-off.yml`](./.github/workflows/pulumi-cooling-off.yml)
    runs on every PR bumping a `@pulumi/*` pin. The job calls

docs/ARCHITECTURE.md

@@ -4,7 +4,7 @@
 
 ## Overview
 
-Hulumi is an Apache-2.0 TypeScript monorepo that ships hardened-by-default Pulumi components for AWS, GitHub, Kubernetes/EKS, and Cloudflare edge, a CrossGuard policy-pack suite, a local-first drift classifier, and a Claude Code skill. Six publishable npm packages share an atomic SLSA Build L3 release path: `@hulumi/baseline`, `@hulumi/policies`, `@hulumi/drift`, `@hulumi/k8s-baseline`, `@hulumi/cloudflare-baseline`, and `@hulumi/platform-patterns`, all aligned on v1.3.0 for the edge-platform release.
+Hulumi is an Apache-2.0 TypeScript monorepo that ships hardened-by-default Pulumi components for AWS, GitHub, Kubernetes/EKS, and Cloudflare edge, a CrossGuard policy-pack suite, a local-first drift classifier, and a Claude Code skill. Six publishable npm packages share an atomic SLSA Build L3 release path: `@hulumi/baseline`, `@hulumi/policies`, `@hulumi/drift`, `@hulumi/k8s-baseline`, `@hulumi/cloudflare-baseline`, and `@hulumi/platform-patterns`, all aligned on v1.3.1 for the edge-platform release.
 
 ## Workspace Structure
 

docs/cookbooks/verify-provenance.md

@@ -20,8 +20,8 @@ Your supply-chain policy requires you to verify provenance before consuming thir
 ### 1. Pack the tarball locally without installing it
 
 ```bash
-npm pack @hulumi/baseline@1.3.0 --pack-destination /tmp --json
-# -> [{"filename":"hulumi-baseline-1.3.0.tgz","files":[...]}]
+npm pack @hulumi/baseline@1.3.1 --pack-destination /tmp --json
+# -> [{"filename":"hulumi-baseline-1.3.1.tgz","files":[...]}]
 ```
 
 Repeat for every `@hulumi/*` package you intend to install. The `release:verify-attestations` script in the root [package.json](../../package.json) does all six published packages in one shot:
@@ -33,13 +33,13 @@ pnpm run release:verify-attestations
 ### 2. Verify the attestation against the canonical repo
 
 ```bash
-gh attestation verify /tmp/hulumi-baseline-1.3.0.tgz --repo kerberosmansour/hulumi
+gh attestation verify /tmp/hulumi-baseline-1.3.1.tgz --repo kerberosmansour/hulumi
 ```
 
 Expected output (paraphrased):
 
 ```
-Loaded digest sha256:... for file:///tmp/hulumi-baseline-1.3.0.tgz
+Loaded digest sha256:... for file:///tmp/hulumi-baseline-1.3.1.tgz
 Loaded 1 attestation from GitHub API
 ✓ Verification succeeded!
 The attestation was generated by https://github.com/kerberosmansour/hulumi
@@ -58,12 +58,12 @@ If verification fails, **stop**. A failed verification means either:
 ```json
 {
   "dependencies": {
-    "@hulumi/baseline": "1.3.0",
-    "@hulumi/policies": "1.3.0",
-    "@hulumi/drift": "1.3.0",
-    "@hulumi/k8s-baseline": "1.3.0",
-    "@hulumi/cloudflare-baseline": "1.3.0",
-    "@hulumi/platform-patterns": "1.3.0"
+    "@hulumi/baseline": "1.3.1",
+    "@hulumi/policies": "1.3.1",
+    "@hulumi/drift": "1.3.1",
+    "@hulumi/k8s-baseline": "1.3.1",
+    "@hulumi/cloudflare-baseline": "1.3.1",
+    "@hulumi/platform-patterns": "1.3.1"
   }
 }
 ```

docs/development.md

@@ -183,7 +183,7 @@ Releases are atomic across the six packages — `@hulumi/baseline`, `@hulumi/pol
 1. Tag `v<x.y.z>` on `main`.
 2. `.github/workflows/release.yml` builds, attests, and publishes via npm trusted publishing (OIDC, no `NPM_TOKEN`).
 3. Post-publish, `release:verify-attestations` (in the root `package.json`) verifies the freshly-published tarballs against the canonical repo.
-4. Publish any prepared GitHub Security Advisories for fixes included in the release. For v1.3.0, use [`docs/release/v1.3.0-security-advisories.md`](./release/v1.3.0-security-advisories.md).
+4. Publish any prepared GitHub Security Advisories for fixes included in the release. For v1.3.1, use [`docs/release/v1.3.1-security-advisories.md`](./release/v1.3.1-security-advisories.md).
 5. CHANGELOG.md updated under the new version heading.
 
 If a publish goes wrong, **don't `npm unpublish`.** Cut a `<x.y.z+1>` patch instead — unpublishing breaks downstream lockfiles for everyone who installed in the failure window. See [SECURITY.md](../SECURITY.md) for the responsible-disclosure path if the publish was compromised.

…cs/release/v1.3.0-security-advisories.md …cs/release/v1.3.1-security-advisories.mddocs/release/v1.3.0-security-advisories.md renamed to docs/release/v1.3.1-security-advisories.md docs/release/v1.3.0-security-advisories.md renamed to docs/release/v1.3.1-security-advisories.md

@@ -1,7 +1,7 @@
-# v1.3.0 Security Advisory Registration Checklist
+# v1.3.1 Security Advisory Registration Checklist
 
-This checklist prepares the GHSA registrations for the v1.3.0 package
-release. Publish the advisories only after the `v1.3.0` release workflow has
+This checklist prepares the GHSA registrations for the v1.3.1 package
+release. Publish the advisories only after the `v1.3.1` release workflow has
 completed and the patched npm tarballs are visible.
 
 GitHub's repository security advisory API is documented at
@@ -14,31 +14,31 @@ patched versions.
 
 | Source     | Draft title                                                                  | Affected product                  | Vulnerable range               | Patched version | Suggested severity | CWE       |
 | ---------- | ---------------------------------------------------------------------------- | --------------------------------- | ------------------------------ | --------------- | ------------------ | --------- |
-| PR #80     | CloudTrail selector tampering events were not fully detected                 | `@hulumi/baseline`                | `< 1.3.0`                      | `1.3.0`         | Medium             | `CWE-778` |
-| PR #119    | Threat-model skill helper script root could be shadowed by workspace files   | `/hulumi-threat-model` skill      | repo revisions before `v1.3.0` | `v1.3.0`        | Medium             | `CWE-426` |
-| PR #120    | HULUMI-H1 SecureBucket parent spoof bypass                                   | `@hulumi/policies`                | `< 1.3.0`                      | `1.3.0`         | High               | `CWE-284` |
-| PR #121    | CIS 1.16 admin policy bypass for inline and attached IAM policies            | `@hulumi/policies`                | `< 1.3.0`                      | `1.3.0`         | High               | `CWE-269` |
-| PR #122    | SCP allowed `hulumi:iac-role` tag-on-create bypass                           | deployment SCP template and guide | repo revisions before `v1.3.0` | `v1.3.0`        | High               | `CWE-284` |
-| PR #123    | Orphan reconciler accepted externally supplied execute plans                 | `@hulumi/drift`                   | `< 1.3.0`                      | `1.3.0`         | High               | `CWE-345` |
-| PR #124    | Weekly integration IAM policy enabled role privilege escalation              | deployment IAM policy guide       | repo revisions before `v1.3.0` | `v1.3.0`        | High               | `CWE-269` |
-| 2026-05-15 | GitHub OIDC trust policy bypass via AWS set-qualified condition operators    | `@hulumi/policies`                | `< 1.3.0`                      | `1.3.0`         | High               | `CWE-284` |
-| 2026-05-15 | Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails | `@hulumi/policies`                | `< 1.3.0`                      | `1.3.0`         | High               | `CWE-693` |
+| PR #80     | CloudTrail selector tampering events were not fully detected                 | `@hulumi/baseline`                | `< 1.3.1`                      | `1.3.1`         | Medium             | `CWE-778` |
+| PR #119    | Threat-model skill helper script root could be shadowed by workspace files   | `/hulumi-threat-model` skill      | repo revisions before `v1.3.1` | `v1.3.1`        | Medium             | `CWE-426` |
+| PR #120    | HULUMI-H1 SecureBucket parent spoof bypass                                   | `@hulumi/policies`                | `< 1.3.1`                      | `1.3.1`         | High               | `CWE-284` |
+| PR #121    | CIS 1.16 admin policy bypass for inline and attached IAM policies            | `@hulumi/policies`                | `< 1.3.1`                      | `1.3.1`         | High               | `CWE-269` |
+| PR #122    | SCP allowed `hulumi:iac-role` tag-on-create bypass                           | deployment SCP template and guide | repo revisions before `v1.3.1` | `v1.3.1`        | High               | `CWE-284` |
+| PR #123    | Orphan reconciler accepted externally supplied execute plans                 | `@hulumi/drift`                   | `< 1.3.1`                      | `1.3.1`         | High               | `CWE-345` |
+| PR #124    | Weekly integration IAM policy enabled role privilege escalation              | deployment IAM policy guide       | repo revisions before `v1.3.1` | `v1.3.1`        | High               | `CWE-269` |
+| 2026-05-15 | GitHub OIDC trust policy bypass via AWS set-qualified condition operators    | `@hulumi/policies`                | `< 1.3.1`                      | `1.3.1`         | High               | `CWE-284` |
+| 2026-05-15 | Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails | `@hulumi/policies`                | `< 1.3.1`                      | `1.3.1`         | High               | `CWE-693` |
 
 `ProtectedAdminHostname` regex hardening from PR #126 is intentionally not in
 the advisory list because `@hulumi/cloudflare-baseline` first publishes at
-`1.3.0`; no vulnerable public npm version exists.
+`1.3.1`; no vulnerable public npm version exists.
 
 ## Publication Steps
 
-1. Confirm `.github/workflows/release.yml` succeeded for tag `v1.3.0`.
+1. Confirm `.github/workflows/release.yml` succeeded for tag `v1.3.1`.
 2. Confirm all six npm tarballs are visible:
    `@hulumi/baseline`, `@hulumi/policies`, `@hulumi/drift`,
    `@hulumi/k8s-baseline`, `@hulumi/cloudflare-baseline`, and
    `@hulumi/platform-patterns`.
 3. Run `pnpm run release:verify-attestations` against the published tarballs.
 4. Create draft advisories in GitHub Security Advisories. For npm packages,
-   set ecosystem `npm`, package name, vulnerable range `< 1.3.0`, and patched
-   version `1.3.0`.
+   set ecosystem `npm`, package name, vulnerable range `< 1.3.1`, and patched
+   version `1.3.1`.
 5. For skill/docs/deployment assets, do not pretend there is an npm package.
    Use GitHub's advisory UI/API support for repository-level or other affected
    products where available, and keep the affected product text explicit.