fix: use OIDC trusted publishing instead of npm token for releases#1031
fix: use OIDC trusted publishing instead of npm token for releases#1031
Conversation
rfgamaral
added
the
👀 Show PR
doistbot
left a comment
doistbot
left a comment
There was a problem hiding this comment.
This PR updates the release workflow to rely on OIDC trusted publishing rather than an npm token while cleanly aligning the process with Typist's established setup. These adjustments improve the security and consistency of the deployment pipeline by eliminating unnecessary tokens and standardizing the steps. There are just a few details to address to ensure everything runs smoothly, including coordinating the workflow file rename with the npm trusted publisher configuration, incorporating patch files into the dependency cache key to avoid stale builds, and guarding $GITHUB_OUTPUT references in the release configuration so local dry runs do not break.
Remove registry-url from setup-node so the repo .npmrc is preserved, enabling OIDC authentication for npm publishing. Remove NODE_AUTH_TOKEN and the NPM_TOKEN secret dependency. Also align the release workflow with the Typist reference implementation: use package-published output from semantic-release instead of tag-diff detection, add node_modules caching, explicit build step, and consistent step naming.
rfgamaral
force-pushed
the
ricardo/fix-oidc-release-workflow
branch
from
0a70266 to
6cb58bf
Compare
rfgamaral
requested review from
a team and
scottlovegrove
and removed request for
a team
## [30.1.4](v30.1.3...v30.1.4) (2026-04-08) ### Bug Fixes * use OIDC trusted publishing instead of npm token for releases ([#1031](#1031)) ([e15f898](e15f898))
|
🎉 This PR is included in version 30.1.4 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
Nice one, thank you 🙌 |
4 participants
Short description
The release workflow was using
registry-urlinsetup-node, which overwrote the repo's.npmrcand required anNPM_TOKENfor authentication. This broke OIDC trusted publishing, which PR #1026 "fixed" by adding the token back. That was the wrong direction: the token is unnecessary when OIDC is configured correctly.This PR removes
registry-urlfrom the initialsetup-nodestep so the repo.npmrcis preserved and OIDC handles npm authentication without a token.The workflow was also aligned with Typist's release workflow:
package-publishedoutput from semantic-release instead of tag-diff detection,node_modulescaching, explicit build step, consistent step naming, andGH_PACKAGES_TOKENfor GitHub Packages publishing. One difference from Typist: Reactist keeps the GitHub App token (create-github-app-token) instead ofGH_REPO_TOKEN, because Reactist has a branch ruleset onmainthat requires the App as a bypass actor for semantic-release to push release commits. Typist has no such ruleset, but would break if one were added. This is something we should bring back to Typist.Pre-merge checklist
publish-package-release.yml(wasrelease.yml)