yenkins-admin · Nov 3, 2026 · Nov 3, 2026 · Nov 3, 2026
diff --git a/.github/actions/npm/publish-tarballs/action.yml b/.github/actions/npm/publish-tarballs/action.yml
@@ -0,0 +1,76 @@
+name: Publish tarballs to npm with trusted publishing
+description: |
+  Downloads the artifact from gooddata/gooddata-ui-sdk/.github/actions/rush/pack-for-publish@master
+  and publishes each tarball to npm. There is no npm token, so npm must use trusted
+  publishing (OIDC). Use it only on a GitHub-hosted runner (npm does not support self-hosted
+  runners for trusted publishing) in a job with the "id-token: write" permission.
+
+inputs:
+  artifact-name:
+    required: true
+    description: "Name of the artifact with the tarballs"
+  release-tag:
+    required: true
+    description: "npm dist-tag, e.g. prerelease, latest"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Node.js
+      uses: actions/setup-node@v7.1.0
+      with:
+        # npm trusted publishing requires npm >= 11.5.1 (Node 24.12.0 bundles npm 11.6.2)
+        node-version: 24.12.0
+
+    - name: Download tarballs
+      uses: actions/download-artifact@v8.0.2
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: ${{ runner.temp }}/npm-tarballs
+
+    - name: Publish tarballs
+      shell: bash
+      env:
+        TAG: ${{ inputs.release-tag }}
+        TARBALLS: ${{ runner.temp }}/npm-tarballs
+      run: |
+        set -uo pipefail
+        echo "npm $(npm --version)"
+        cat "$TARBALLS/manifest.txt"
+
+        failed=()
+        while read -r tgz; do
+          # The folder name is the Rush version policy.
+          policy=$(basename "$(dirname "$tgz")")
+          access=public
+          if [ "$policy" = "gdc-ui-private" ]; then
+            access=restricted
+          fi
+
+          for attempt in 1 2 3; do
+            echo "::group::npm publish $tgz --tag $TAG --access $access (attempt $attempt)"
+            # The shell runs with -e. "|| status=$?" keeps a failed publish from ending the script.
+            status=0
+            out=$(npm publish "$TARBALLS/$tgz" --tag "$TAG" --access "$access" --ignore-scripts 2>&1 < /dev/null) || status=$?
+            echo "$out"
+            echo "::endgroup::"
+            if [ $status -eq 0 ]; then
+              break
+            fi
+            # A retry after a publish that worked, but reported an error.
+            if grep -q "cannot publish over the previously published version" <<< "$out"; then
+              echo "Skip $tgz. Already published."
+              break
+            fi
+            if [ $attempt -eq 3 ]; then
+              failed+=("$tgz")
+            else
+              sleep 10
+            fi
+          done
+        done < "$TARBALLS/manifest.txt"
+
+        if [ ${#failed[@]} -gt 0 ]; then
+          echo "::error::Publish failed for: ${failed[*]}"
+          exit 1
+        fi
diff --git a/.github/actions/rush/pack-for-publish/action.yml b/.github/actions/rush/pack-for-publish/action.yml
@@ -0,0 +1,66 @@
+name: Pack packages for npm publish
+description: |
+  Packs the packages of the given Rush version policies into tarballs, removes the
+  tarballs whose version is already on npm, and uploads the rest as an artifact.
+  Use it on the self-hosted runner, then publish the artifact with
+  gooddata/gooddata-ui-sdk/.github/actions/npm/publish-tarballs@master on a GitHub-hosted
+  runner (npm trusted publishing).
+  This action assumes that the packages are built.
+
+inputs:
+  policies:
+    required: true
+    description: "Space-separated Rush version policies, e.g. 'sdk aac gdc-ui-private'"
+  artifact-name:
+    required: true
+    description: "Name of the uploaded artifact (must be unique in the workflow run)"
+  npm-auth-token:
+    required: true
+    description: "npm token to read restricted packages when checking for already published versions"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Pack and remove already published versions
+      shell: bash
+      env:
+        POLICIES: ${{ inputs.policies }}
+        NPM_AUTH_TOKEN: ${{ inputs.npm-auth-token }}
+        TARBALLS: ${{ runner.temp }}/npm-tarballs
+      run: |
+        set -euo pipefail
+        rm -rf "$TARBALLS"
+
+        # --pack only writes tarballs; it never publishes.
+        for policy in $POLICIES; do
+          node common/scripts/install-run-rush.js publish --publish --pack --include-all \
+            --version-policy "$policy" --release-folder "$TARBALLS/$policy"
+        done
+
+        # Same as "rush publish": do not publish a version that is already on npm.
+        printf '//registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}\n' > "$RUNNER_TEMP/pack-for-publish.npmrc"
+        export NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/pack-for-publish.npmrc"
+        shopt -s nullglob
+        for tgz in "$TARBALLS"/*/*.tgz; do
+          spec=$(tar -xOzf "$tgz" package/package.json | node -p 'const p = JSON.parse(require("fs").readFileSync(0)); `${p.name}@${p.version}`')
+          if [ -n "$(npm view "$spec" version 2>/dev/null)" ]; then
+            echo "Skip $spec. Already published."
+            rm "$tgz"
+          else
+            echo "Publish $spec"
+          fi
+        done
+        rm "$NPM_CONFIG_USERCONFIG"
+
+        # The manifest makes sure that the artifact exists, also when there is nothing to publish.
+        (cd "$TARBALLS" && find . -name '*.tgz' | sort > manifest.txt)
+        echo "Tarballs to publish: $(wc -l < "$TARBALLS/manifest.txt")"
+        du -sh "$TARBALLS"
+
+    - name: Upload tarballs
+      uses: actions/upload-artifact@v7.0.2
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: ${{ runner.temp }}/npm-tarballs
+        retention-days: 1
+        overwrite: true
diff --git a/.github/workflows/prerelease-alpha.yml b/.github/workflows/prerelease-alpha.yml
@@ -3,6 +3,12 @@
 name: Prerelease ~ Publish alpha
 on:
     workflow_dispatch:
+        inputs:
+            use-npm-token:
+                required: false
+                default: false
+                description: "Publish to npm the old way with NPM_PUBLISH_TOKEN instead of trusted publishing (OIDC)"
+                type: boolean
 jobs:
     publish-pre-release:
         uses: ./.github/workflows/rw-publish-prerelease.yml
@@ -12,3 +18,4 @@ jobs:
         secrets: inherit
         with:
             source-branch: "master"
+            use-trusted-publishing: ${{ inputs.use-npm-token != true }}
diff --git a/.github/workflows/prerelease-beta-patch.yml b/.github/workflows/prerelease-beta-patch.yml
@@ -6,14 +6,28 @@ on:
       inputs:
         version:
             required: true
-            description: "Specify the minor version to patch (example: 9.5.0)"
+            description: "Specify the 9.x minor version to patch (example: 9.9.0). gooddata-ui-sdk releases only 9.x, release the newer versions from gdc-ui."
             type: string
+        use-npm-token:
+            required: false
+            default: false
+            description: "Publish to npm the old way with NPM_PUBLISH_TOKEN instead of trusted publishing (OIDC)"
+            type: boolean
 jobs:
     check-input-version-param:
         runs-on: ubuntu-latest
         outputs:
             branch: ${{ steps.check-input-version-param.outputs.branch }}
         steps:
+            # gooddata-ui-sdk releases only the 9.x (bear) versions. Release the newer versions from gdc-ui.
+            - name: Check that the version is 9.x
+              run: |
+                  if [[ ! "$VERSION" =~ ^9\.[0-9]+\.[0-9]+$ ]]; then
+                    echo "::error::gooddata-ui-sdk releases only the 9.x (bear) versions, not ${VERSION}. Release the newer versions from gdc-ui."
+                    exit 1
+                  fi
+              env:
+                  VERSION: ${{ inputs.version }}
             - name: Checkout code
               uses: actions/checkout@v7.0.1
             - name: Check if branch for version exists
@@ -38,3 +52,4 @@ jobs:
         secrets: inherit
         with:
             source-branch: ${{ needs.check-input-version-param.outputs.branch }}
+            use-trusted-publishing: ${{ inputs.use-npm-token != true }}
diff --git a/.github/workflows/release-release-minor.yml b/.github/workflows/release-release-minor.yml
@@ -3,6 +3,12 @@
 name: Release ~ Release minor version (complete)
 on:
   workflow_dispatch:
+    inputs:
+      use-npm-token:
+        required: false
+        default: false
+        description: "Publish to npm the old way with NPM_PUBLISH_TOKEN instead of trusted publishing (OIDC)"
+        type: boolean
 
 jobs:
   gate-approval:
@@ -92,6 +98,7 @@ jobs:
     with:
       bump: 'minor'
       source-branch: ${{ needs.get-version.outputs.branch }}
+      use-trusted-publishing: ${{ inputs.use-npm-token != true }}
 
   update-hugo-version:
     needs: [publish-release, get-version]

diff --git a/.github/workflows/release-release-patch.yml b/.github/workflows/release-release-patch.yml
@@ -6,15 +6,29 @@ on:
       inputs:
         version:
             required: true
-            description: "Specify the minor version to patch (example: 9.5.0)"
+            description: "Specify the 9.x minor version to patch (example: 9.9.0). gooddata-ui-sdk releases only 9.x, release the newer versions from gdc-ui."
             type: string
+        use-npm-token:
+            required: false
+            default: false
+            description: "Publish to npm the old way with NPM_PUBLISH_TOKEN instead of trusted publishing (OIDC)"
+            type: boolean
 
 jobs:
     check-input-version-param:
         runs-on: ubuntu-latest
         outputs:
             branch: ${{ steps.check-input-version-param.outputs.branch }}
         steps:
+            # gooddata-ui-sdk releases only the 9.x (bear) versions. Release the newer versions from gdc-ui.
+            - name: Check that the version is 9.x
+              run: |
+                  if [[ ! "$VERSION" =~ ^9\.[0-9]+\.[0-9]+$ ]]; then
+                    echo "::error::gooddata-ui-sdk releases only the 9.x (bear) versions, not ${VERSION}. Release the newer versions from gdc-ui."
+                    exit 1
+                  fi
+              env:
+                  VERSION: ${{ inputs.version }}
             - name: Checkout code
               uses: actions/checkout@v7.0.1
             - name: Check branch for version exists
@@ -50,3 +64,4 @@ jobs:
       secrets: inherit
       with:
         source-branch: ${{needs.check-input-version-param.outputs.branch}}
+        use-trusted-publishing: ${{ inputs.use-npm-token != true }}
diff --git a/.github/workflows/rw-perform-release-patch.yml b/.github/workflows/rw-perform-release-patch.yml
@@ -6,6 +6,11 @@ on:
                 required: true
                 description: "Source branch to release from (release, rel/*)"
                 type: string
+            use-trusted-publishing:
+                required: false
+                default: true
+                description: "Publish to npm via trusted publishing (OIDC) only, without NPM_PUBLISH_TOKEN"
+                type: boolean
 
 jobs:
     publish-release:
@@ -17,6 +22,7 @@ jobs:
         with:
             bump: "patch"
             source-branch: ${{ inputs.source-branch }}
+            use-trusted-publishing: ${{ inputs.use-trusted-publishing }}
 
     prepare-variables:
         runs-on: [ubuntu-latest]

diff --git a/.github/workflows/rw-publish-prerelease.yml b/.github/workflows/rw-publish-prerelease.yml
@@ -13,6 +13,11 @@ on:
         default: false
         description: "Skip bumping the version"
         type: boolean
+      use-trusted-publishing:
+        required: false
+        default: true
+        description: "Publish to npm via trusted publishing (OIDC) only, without NPM_PUBLISH_TOKEN"
+        type: boolean
     outputs:
       version:
         description: "The version that was published"
@@ -113,6 +118,7 @@ jobs:
     with:
       source-branch: ${{ inputs.source-branch }}
       release-tag: ${{ needs.setup-params.outputs.prerelease-tag }}
+      use-trusted-publishing: ${{ inputs.use-trusted-publishing }}
 
   slack-notification:
     runs-on:

diff --git a/.github/workflows/rw-publish-release.yml b/.github/workflows/rw-publish-release.yml
@@ -12,6 +12,11 @@ on:
         required: true
         description: "The type of version bump (major, minor, patch)"
         type: string
+      use-trusted-publishing:
+        required: false
+        default: true
+        description: "Publish to npm via trusted publishing (OIDC) only, without NPM_PUBLISH_TOKEN"
+        type: boolean
     outputs:
       version:
         description: "Version which was created"
@@ -115,6 +120,7 @@ jobs:
     with:
       source-branch: ${{ inputs.source-branch }}
       release-tag: ${{ needs.prape-release-releasde-tag.outputs.release_tag }}
+      use-trusted-publishing: ${{ inputs.use-trusted-publishing }}
 
   check-npm-package:
     outputs:

diff --git a/.github/workflows/rw-publish-version.yml b/.github/workflows/rw-publish-version.yml
@@ -12,6 +12,11 @@ on:
                 required: true
                 description: "The release NPM tag e.g. prerelease, latest, hotfix ..."
                 type: string
+            use-trusted-publishing:
+                required: false
+                default: true
+                description: "Publish to npm via trusted publishing (OIDC) only, without NPM_PUBLISH_TOKEN"
+                type: boolean
 
 jobs:
     publish-version:
@@ -43,6 +48,7 @@ jobs:
               run: |
                   node common/scripts/install-run-rush.js publish --include-all --version-policy sdk --set-access-level public
             - name: Rush publish
+              if: ${{ !inputs.use-trusted-publishing }}
               uses: nick-fields/retry@v4.0.0
               env:
                   NPM_PUBLISH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
@@ -55,9 +61,35 @@ jobs:
                   command: |
                       node common/scripts/install-run-rush.js publish --publish --include-all --version-policy sdk --tag $TAG --set-access-level public
 
-    notify-publish-failed-to-slack:
-        if: ${{ !cancelled() && needs.publish-version.result  == 'failure' }}
+            # Trusted publishing: npm does not support self-hosted runners and the npm tokens
+            # work only on them. So pack here and publish in publish-version-trusted.
+            # The action comes from master, because the source branch (e.g. an old rel/X.Y)
+            # does not always have it.
+            - name: Pack for trusted publishing
+              if: ${{ inputs.use-trusted-publishing }}
+              uses: gooddata/gooddata-ui-sdk/.github/actions/rush/pack-for-publish@master
+              with:
+                  policies: "sdk"
+                  artifact-name: npm-tarballs-${{ inputs.release-tag }}
+                  npm-auth-token: ${{ secrets.NPM_TOKEN }}
+
+    publish-version-trusted:
+        if: ${{ inputs.use-trusted-publishing }}
         needs: publish-version
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
+        steps:
+            - name: Publish tarballs with trusted publishing
+              uses: gooddata/gooddata-ui-sdk/.github/actions/npm/publish-tarballs@master
+              with:
+                  artifact-name: npm-tarballs-${{ inputs.release-tag }}
+                  release-tag: ${{ inputs.release-tag }}
+
+    notify-publish-failed-to-slack:
+        if: ${{ !cancelled() && (needs.publish-version.result == 'failure' || needs.publish-version-trusted.result == 'failure') }}
+        needs: [publish-version, publish-version-trusted]
         runs-on: [ubuntu-latest]
         steps:
             - name: Checkout repository

diff --git a/common/changes/@gooddata/sdk-ui-all/pdo-host-chat-channel_2026-10-29-14-10.json b/common/changes/@gooddata/sdk-ui-all/pdo-host-chat-channel_2026-10-29-14-10.json
@@ -0,0 +1,10 @@
+{
+    "changes": [
+        {
+            "packageName": "@gooddata/sdk-ui-all",
+            "comment": "sdk-pluggable-application-model: the AI assistant chat channel is generic in both directions. `IAiAssistantChatEvent` types what the host chat hands to an application (`onAiAssistantEventReceive`) and `IAiAssistantEventSentEvent` carries an `IAiAssistantAppEvent` from the application to the chat; the publisher-document-saved and dashboard-saved pluggable events are now app events under that envelope. sdk-ui-gen-ai: `GenAIChatDialogConnected` takes one `appEvent` prop in place of `publisherDocumentSaved` and `dashboardSaved`.",
+            "type": "none"
+        }
+    ],
+    "packageName": "@gooddata/sdk-ui-all"
+}
diff --git a/common/changes/@gooddata/sdk-ui-all/zo-f1-3034-delete-button-keyboard_2026-11-02-00-00.json b/common/changes/@gooddata/sdk-ui-all/zo-f1-3034-delete-button-keyboard_2026-11-02-00-00.json
@@ -0,0 +1,10 @@
+{
+    "changes": [
+        {
+            "comment": "sdk-ui-kit: The delete button in the visualization list can be activated with Enter and Space.",
+            "type": "none",
+            "packageName": "@gooddata/sdk-ui-all"
+        }
+    ],
+    "packageName": "@gooddata/sdk-ui-all"
+}