Trusted Publishing

[mattherman]

We previously used an NPM token configured to bypass 2FA in order to publish packages. That will no longer be supported soon.

Both mountebank and mountebank-formatters have been updated to use Trusted Publishers instead, which use OIDC to retrieve a short-lived token within the CI job.

[mattherman]

Relevant MRs:

• Update deploy jobs to use trusted publishers rather than tokens mountebank#942
• Bump Node version to 24.19.0 to ensure we have an npm with CircleCI t… mountebank#944
• Update deploy to use trusted publishing mountebank-formatters#9

[gokhanibrikci]

One data point in case it helps: npm's latest for mountebank is still 2.9.1
(published 2023-08-23), so v2.9.2–v2.9.4 have not reached npm even though the
workflows are in place.

If the publish is still failing, this may be the cause — I hit exactly this on my own
package a few days ago. The trusted publisher has to exist as a record on npmjs.com
for that specific package, created by someone with access to it (package → Settings →
Trusted publisher: provider, org/user, repo, workflow filename). Until that record
exists the registry answers the OIDC token exchange with

POST /-/npm/v1/oidc/token/exchange/package/<name> → 404
OIDC token exchange error - package not found

which reads like a missing package rather than a missing setting. npm publish then
reports ENEEDAUTH or a plain 404 on the PUT. The npm maintainer list for mountebank
shows only bbyars, so that record may still need him.

[gokhanibrikci]

Correction to my earlier comment: I had this wrong, and I am sorry for the noise.

I read npm's mountebank sitting at 2.9.1 and concluded that publishing was failing. It is
not — the package was renamed, and @mbtest/mountebank has 2.9.2, 2.9.3 and 2.9.4, the last
of them in April. Nothing was broken; I was looking at the old name.

One thing that may still be worth knowing, since it is what led me there: mountebank on npm
gets about 30,000 downloads a week and @mbtest/mountebank about 4,000, so most installs are
still landing on the 2023 build with the advisories 2.9.2–2.9.4 fixed. A deprecation notice on
the old name (npm deprecate mountebank "renamed to @mbtest/mountebank") would put a line in
front of every one of those installs, if whoever holds that name is willing.

My own package now depends on @mbtest/mountebank@^2.9.4.