From 6929ec9d74c9bb6495ef344f7c2b308a78927a32 Mon Sep 17 00:00:00 2001
From: nca-work <219591949+nca-work@users.noreply.github.com>
Date: Wed, 22 Apr 2026 14:28:36 +1200
Subject: [PATCH 1/2] chore: Rename CAB to ORR

---
 .github/workflows/publish.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bda3998b..957a6f24 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -2,8 +2,8 @@ name: Publish & Release SDK
 on:
   workflow_dispatch:
     inputs:
-      cab_id:
-        description: "CAB id for the change/release"
+      orr_id:
+        description: "ORR id for the change/release"
         required: true
         type: string
 
@@ -102,7 +102,7 @@ jobs:
                   "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
                   "environment": "prod",
                   "sdk_type": "node",
-                  "cab_key": "${{ github.event.inputs.cab_id }}"
+                  "cab_key": "${{ github.event.inputs.orr_id }}"
                   }
                 }'
 

From 89021b7e835edb470ff0d27a70a6256266fe5ebc Mon Sep 17 00:00:00 2001
From: nca-work <219591949+nca-work@users.noreply.github.com>
Date: Wed, 22 Apr 2026 14:29:36 +1200
Subject: [PATCH 2/2] ci: Add support for trusted publisher workflow

---
 .github/workflows/publish.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 957a6f24..43e6d1a8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,12 @@ on:
         description: "ORR id for the change/release"
         required: true
         type: string
+        default: ORR-8317
+      dry_run:
+        description: "Run the publish step in dry-run"
+        required: true
+        type: boolean
+        default: false
 
 jobs:
   publish:
@@ -14,6 +20,7 @@ jobs:
     outputs:
       release_number: ${{steps.get_latest_release_number.outputs.release_tag}}
     permissions:
+      id-token: write
       contents: write
       pull-requests: write
     steps:
@@ -24,7 +31,7 @@ jobs:
           path: xero-node
 
       - name: Set up Node environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: 'npm'
@@ -52,7 +59,7 @@ jobs:
       - name: Publish to npm
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish
+        run: npm publish ${{ inputs.dry_run && '--dry-run' || '' }}
         working-directory: xero-node
 
   notify-codegen-repo: