ci: npm publish via OIDC Trusted Publishing (no token) - #25
Conversation
Drop NODE_AUTH_TOKEN / NPM_TOKEN and authenticate the release with the GitHub Actions OIDC id-token instead. Requires npm >= 11.5.1 (node 22 ships 10.x), so upgrade npm first. Provenance is generated from the same OIDC identity. The package must have a Trusted Publisher configured at npmjs.com pointing at this repo's release.yml. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe npm publish workflow in Changesnpm OIDC Trusted Publishing migration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #25 +/- ##
=======================================
Coverage 80.61% 80.61%
=======================================
Files 45 45
Lines 4782 4782
=======================================
Hits 3855 3855
Misses 927 927
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 29-33: The "Upgrade npm for Trusted Publishing" step in the
release workflow is using npm@latest which causes non-deterministic release
behavior when new npm versions are published. Replace npm@latest with a pinned
version number (use npm@11.5.1 or a validated patch version of that release) in
the npm install -g command to ensure consistent and reproducible releases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ed83d42b-91a6-49b0-b765-4c1a97f47125
📒 Files selected for processing (1)
.github/workflows/release.yml
| # OIDC Trusted Publishing requires the npm CLI >= 11.5.1; node 22 ships | ||
| # an older 10.x. No token after this — auth is the GitHub OIDC id-token. | ||
| - name: Upgrade npm for Trusted Publishing | ||
| run: npm install -g npm@latest | ||
|
|
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major
🧩 Analysis chain
🌐 Web query:
What is the minimum npm CLI version required for npm Trusted Publishing with GitHub Actions OIDC, and are there any known caveats for npm 11.x on Node 22?
💡 Result:
The minimum npm CLI version required for npm Trusted Publishing with GitHub Actions OIDC is 11.5.1 [1][2][3]. Regarding Node 22 and npm 11.x, there are no inherent incompatibilities between them; rather, the caveat is that Node 22 does not ship with the required npm version (it includes an older npm 10.x version by default) [4]. Consequently, attempting to use Trusted Publishing directly on a default Node 22 environment will fail, often resulting in a misleading "404" error during the publish step [5][4]. To use Trusted Publishing while remaining on Node 22, you must explicitly upgrade the npm CLI within your workflow before running the publish command [5][6][4]: - run: npm install -g npm@latest Alternatively, you can switch to Node 24, which is bundled with a sufficiently recent version of the npm CLI [5][3][4]. Ensure your workflow also includes the required permissions: permissions: id-token: write contents: read Finally, note that Trusted Publishing is only supported on supported cloud providers (such as GitHub-hosted runners) and does not support self-hosted runners [1][6]. Ensure all configuration fields—such as the repository, workflow filename, and environment name—match exactly, as these are case-sensitive and mismatches may also cause authentication failures [1][3][6][4].
Citations:
- 1: https://docs.npmjs.com/trusted-publishers/
- 2: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/
- 3: https://github.com/npm/documentation/blob/main/content/packages-and-modules/securing-your-code/trusted-publishers.mdx
- 4: https://varstatt.com/jurij/p/npm-trusted-publishing-from-github-actions
- 5: https://stackoverflow.com/questions/79952803/why-am-i-getting-a-404-when-i-use-trusted-publishing-to-publish-from-github-acti
- 6: https://datafrog.io/blog/npm-trusted-publishing-github-actions-without-npm-token
Pin npm to a deterministic version instead of latest.
Line 32 makes release behavior drift over time; a new npm release can break publishing unexpectedly. The minimum version required for OIDC Trusted Publishing is 11.5.1—pin to this or a validated patch version on that line rather than chasing latest.
Suggested change
- - name: Upgrade npm for Trusted Publishing
- run: npm install -g npm@latest
+ - name: Upgrade npm for Trusted Publishing
+ run: npm install -g npm@11.5.1🧰 Tools
🪛 zizmor (1.26.1)
[warning] 32-32: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile
(adhoc-packages)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 29 - 33, The "Upgrade npm for
Trusted Publishing" step in the release workflow is using npm@latest which
causes non-deterministic release behavior when new npm versions are published.
Replace npm@latest with a pinned version number (use npm@11.5.1 or a validated
patch version of that release) in the npm install -g command to ensure
consistent and reproducible releases.
Source: Linters/SAST tools
1 participant
Now that
codeoid@0.1.0is on npm, switch CI releases to OIDC Trusted Publishing so noNPM_TOKENis ever needed (and we sidestep the 2FA/EOTP friction entirely).Diff
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}— auth is the GitHub Actions OIDC id-token (the workflow already hasid-token: write).npm install -g npm@latest— Trusted Publishing needs npm >= 11.5.1; node 22 ships 10.x.On npmjs.com → codeoid package → Settings → Trusted Publisher → Add:
saucamcodeoidrelease.ymlAfter that, every
v*tag publishes automatically with no token. You can then revoke theNPM_TOKENsecret and flip your npm 2FA back to "Authorization and writes" — the token no longer matters.🤖 Generated with Claude Code
Summary by CodeRabbit