ci(prerelease): gate npm prerelease publishing behind a protected environment #286

Problem

.github/workflows/prerelease.yml:4-7 publishes to npm on a push to dev or release/** with id-token: write and no environment:. Lines 59-61 interpolate ${{ github.ref_name }} into a run: block.

Scenario

Anyone with write access, or a stolen write-scoped token, pushes a release/x branch and the workflow publishes that branch's code to @seamless-auth/* under rc with no review. A branch name with shell metacharacters runs commands in the job that holds the publish identity.

Plausible: the workflow is as described, but branch rulesets and the npm trusted-publisher binding were not visible to the review.

Fix

• Gate the job behind a protected environment with required reviewers.
• Pass the ref through env: instead of interpolating it into run:.
• Restrict creation of release/** branches.

Related: fells-code/seamless-auth-api#438.

Source

Internal security review of 2026-11-09 (M22), read at 80b7f49. Found by reading code; nothing was executed. Status: Plausible.