Skip to content

Remove NODE_AUTH_TOKEN from stable-release workflow#10950

Merged
sestinj merged 1 commit intomainfrom
sestinj-patch-1
Mar 1, 2026
Merged

Remove NODE_AUTH_TOKEN from stable-release workflow#10950
sestinj merged 1 commit intomainfrom
sestinj-patch-1

Conversation

@sestinj
Copy link
Contributor

@sestinj sestinj commented Mar 1, 2026

Removed NODE_AUTH_TOKEN environment variable from various steps in the stable release workflow.

Description

[ What changed? Feel free to be brief. ]

AI Code Review

  • Team members only: AI review runs automatically when PR is opened or marked ready for review
  • Team members can also trigger a review by commenting @continue-review

Checklist

  • [] I've read the contributing guide
  • [] The relevant docs, if any, have been updated or created
  • [] The relevant tests, if any, have been updated or created

Screen recording or screenshot

[ When applicable, please include a short screen recording or screenshot - this makes it much easier for us as contributors to review and understand your changes. See this PR as a good example. ]

Tests

[ What tests were added or updated to ensure the changes work as expected? ]


Continue Tasks: ❌ 7 failed — View all


Summary by cubic

Switch the stable-release workflow to OIDC-based npm auth and remove step-level NODE_AUTH_TOKEN usage. This reduces secret exposure and supports provenance-enabled publishing.

  • Refactors
    • Added id-token: write permission to the workflow.
    • Removed NODE_AUTH_TOKEN from find_beta, download/verify beta, and publish steps.

Written for commit 966ffe9. Summary will update on new commits.

Removed NODE_AUTH_TOKEN environment variable from various steps in the stable release workflow.
@sestinj sestinj requested a review from a team as a code owner March 1, 2026 17:18
@sestinj sestinj requested review from Patrick-Erichsen and removed request for a team March 1, 2026 17:18
@dosubot dosubot bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Mar 1, 2026
@sestinj sestinj merged commit 60646e5 into main Mar 1, 2026
30 of 40 checks passed
@sestinj sestinj deleted the sestinj-patch-1 branch March 1, 2026 17:18
@github-project-automation github-project-automation bot moved this from Todo to Done in Issues and PRs Mar 1, 2026
@github-actions github-actions bot locked and limited conversation to collaborators Mar 1, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant