Skip to content

ci: npm publish via OIDC Trusted Publishing (no token) #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
saucam merged 1 commit into from
Jun 23, 2026
Merged

ci: npm publish via OIDC Trusted Publishing (no token) #25

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,11 @@ jobs:
node-version: 22
registry-url: "https://registry.npmjs.org"

# OIDC Trusted Publishing requires the npm CLI >= 11.5.1; node 22 ships
# an older 10.x. No token after this — auth is the GitHub OIDC id-token.
- name: Upgrade npm for Trusted Publishing
run: npm install -g npm@latest

Comment on lines +29 to +33

@coderabbitai coderabbitai Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major

🧩 Analysis chain

🌐 Web query:

What is the minimum npm CLI version required for npm Trusted Publishing with GitHub Actions OIDC, and are there any known caveats for npm 11.x on Node 22?

💡 Result:

The minimum npm CLI version required for npm Trusted Publishing with GitHub Actions OIDC is 11.5.1 [1][2][3]. Regarding Node 22 and npm 11.x, there are no inherent incompatibilities between them; rather, the caveat is that Node 22 does not ship with the required npm version (it includes an older npm 10.x version by default) [4]. Consequently, attempting to use Trusted Publishing directly on a default Node 22 environment will fail, often resulting in a misleading "404" error during the publish step [5][4]. To use Trusted Publishing while remaining on Node 22, you must explicitly upgrade the npm CLI within your workflow before running the publish command [5][6][4]: - run: npm install -g npm@latest Alternatively, you can switch to Node 24, which is bundled with a sufficiently recent version of the npm CLI [5][3][4]. Ensure your workflow also includes the required permissions: permissions: id-token: write contents: read Finally, note that Trusted Publishing is only supported on supported cloud providers (such as GitHub-hosted runners) and does not support self-hosted runners [1][6]. Ensure all configuration fields—such as the repository, workflow filename, and environment name—match exactly, as these are case-sensitive and mismatches may also cause authentication failures [1][3][6][4].

Citations:

Pin npm to a deterministic version instead of latest.

Line 32 makes release behavior drift over time; a new npm release can break publishing unexpectedly. The minimum version required for OIDC Trusted Publishing is 11.5.1—pin to this or a validated patch version on that line rather than chasing latest.

Suggested change 
-      - name: Upgrade npm for Trusted Publishing
-        run: npm install -g npm@latest
+      - name: Upgrade npm for Trusted Publishing
+        run: npm install -g npm@11.5.1
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 32-32: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile

(adhoc-packages)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 29 - 33, The "Upgrade npm for
Trusted Publishing" step in the release workflow is using npm@latest which
causes non-deterministic release behavior when new npm versions are published.
Replace npm@latest with a pinned version number (use npm@11.5.1 or a validated
patch version of that release) in the npm install -g command to ensure
consistent and reproducible releases.

Source: Linters/SAST tools

- name: Install dependencies
run: bun install --frozen-lockfile

Expand All @@ -44,10 +49,11 @@ jobs:
exit 1
fi

- name: Publish to npm
# No NODE_AUTH_TOKEN: auth comes from the GitHub OIDC id-token via npm's
# Trusted Publisher (configured on the package at npmjs.com). Provenance
# is generated automatically from the same OIDC identity.
- name: Publish to npm (OIDC Trusted Publishing)
run: npm publish --provenance --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

- name: Create GitHub Release
uses: softprops/action-gh-release@v2
Expand Down
Loading