feat: use npm trusted publishing (OIDC) for release job#1258
Merged
thebiglabasky merged 2 commits intomainfrom Mar 13, 2026
Merged
feat: use npm trusted publishing (OIDC) for release job#1258thebiglabasky merged 2 commits intomainfrom
thebiglabasky merged 2 commits intomainfrom
Conversation
Removes NODE_AUTH_TOKEN from the release job. All npm publishing now uses GitHub OIDC — no long-lived tokens required. The prerelease job was switched to OIDC in the previous PR and has been proven in production (7.6.1 / 7.6.2 published successfully). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Clarifies that release.yml uses OIDC (no token rotation needed) while release-canary.yml still uses NPM_TOKEN. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
MichaelHogers
approved these changes
Mar 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NODE_AUTH_TOKENfrom the release job — npm will authenticate via GitHub OIDC, same as the prerelease jobNPM_TOKENsecret can be kept in GitHub as a break-glass fallback but is no longer referencedContext
This completes the migration to npm trusted publishing started in #1257. The prerelease job has been running on OIDC successfully (7.6.1 / 7.6.2 published without issues).
The release job uses
environment: production— the trusted publisher on npmjs.com is configured with a blank environment field, which acts as a wildcard matching all environments.What changes
prereleasereleaseNPM_TOKENrelease-canaryNPM_TOKENNPM_TOKEN(unchanged, different workflow file)Rollback plan
Revert this commit (adds two lines back). The
NPM_TOKENsecret remains in GitHub. Trusted publisher config on npmjs.com doesn't interfere with token auth.Risks
productionenvironment on the release job adds an environment claim to the OIDC token. The blank environment field on npmjs.com should match regardless, but this is the first time it's tested with a named environment. If it fails, rollback is a one-line revert.Test plan
🤖 Generated with Claude Code