Allow Trusted Publishers to run "npm dist-tag add"

[MarshallOfSound]

Currently the Trusted Publisher docs indicate that the only supported command is npm publish. For packages that maintain multiple release lines the release process in CI normally looks like:

• npm publish --tag=20-x-y
• If this is the latest release line
  • npm dist-tag add my-package@version latest

As an example you can check the dist tags of the electron package on npm. Without this ability we would be unable to switch to Trusted Publisher.

[MarshallOfSound]

Another option would be an addition to the publish syntax to support npm publish --tag=20-x-y --tag=latest to set multiple tags to this newly published thing

[ryok90]

Any chance of getting a response for this one?
If this is accepted as a feature, and the workload is currently too heavy, my team and I can get behind in contributing and getting this done.

[mrgrain]

This is a huge blocker to move to Trusted Publishers.

[MarshallOfSound]

I found a temporary workaround ish, you can vend the NPM_TOKEN via OIDC yourself through the semi-documented npm API that backs the official support.

https://github.com/electron/npm-trusted-auth-action

[mrgrain]

@MarshallOfSound did you manage to get this to work? I'm using the electron action and am still getting 401. 😐

[MarshallOfSound]

Yeah we use it for electron/node-abi if you want to check that out

[mrgrain]

Yeah we use it for electron/node-abi if you want to check that out

Thanks, that's useful! Looks like you are using semantic-release. Is that what's calling dist-tag add in the background? I don't actually see any extra tags for node-abi.

dist-tag add is still failing for me for some reason. 😞

[johnhwhite]

@MarshallOfSound it looks like @semantic-release/npm is calling npm publish under the hood. I think the token may be scoped to only support publish because it does not seem to work for dist-tag add.