Skip to content

v0.1.0

v0.1.0: ci(npm): bootstrap with NPM_TOKEN (revert to OIDC after first publish)
@joshuamoreno1 joshuamoreno1 tagged this 28 May 04:14 
Trusted Publishing (OIDC) can't be configured on npm until the package
exists, so the first publish uses a short-lived granular token.

After the first successful publish:
  1. Add Trusted Publishing on the package (npm package settings → Access).
  2. Delete the NPM_TOKEN repo secret.
  3. Remove the NODE_AUTH_TOKEN env block from this workflow (keep
     permissions.id-token: write and environment: npm-publish).

See NPM_PUBLISHING.md for the full sequence.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Assets 2
Loading