From dfc0a556619bb464d3cfa718ef8f8e73f2eaa9b3 Mon Sep 17 00:00:00 2001 From: Yash Datta Date: Wed, 24 Jun 2026 01:42:40 +0800 Subject: [PATCH] ci: publish to npm via OIDC Trusted Publishing (no token) Drop NODE_AUTH_TOKEN / NPM_TOKEN and authenticate the release with the GitHub Actions OIDC id-token instead. Requires npm >= 11.5.1 (node 22 ships 10.x), so upgrade npm first. Provenance is generated from the same OIDC identity. The package must have a Trusted Publisher configured at npmjs.com pointing at this repo's release.yml. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8eca03b..95fc031 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,6 +26,11 @@ jobs: node-version: 22 registry-url: "https://registry.npmjs.org" + # OIDC Trusted Publishing requires the npm CLI >= 11.5.1; node 22 ships + # an older 10.x. No token after this — auth is the GitHub OIDC id-token. + - name: Upgrade npm for Trusted Publishing + run: npm install -g npm@latest + - name: Install dependencies run: bun install --frozen-lockfile @@ -44,10 +49,11 @@ jobs: exit 1 fi - - name: Publish to npm + # No NODE_AUTH_TOKEN: auth comes from the GitHub OIDC id-token via npm's + # Trusted Publisher (configured on the package at npmjs.com). Provenance + # is generated automatically from the same OIDC identity. + - name: Publish to npm (OIDC Trusted Publishing) run: npm publish --provenance --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Create GitHub Release uses: softprops/action-gh-release@v2