Skip to content

ci(release): switch publish to npm Trusted Publishing (OIDC) #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
salishforge merged 1 commit into from
Apr 18, 2026
Merged

ci(release): switch publish to npm Trusted Publishing (OIDC) #97

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 6 additions & 8 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,16 +28,14 @@ jobs:
registry-url: "https://registry.npmjs.org"
- run: npm ci
- run: npm run build
# Bootstrap publish auth: NODE_AUTH_TOKEN (Classic Automation token).
# @salishforge/memforge does not exist on npm yet, so Trusted Publishing
# cannot be configured for it — trusted publishers are attached to an
# existing package on npmjs.com. After the first publish succeeds, swap
# this step to OIDC by removing NODE_AUTH_TOKEN (id-token: write is
# already granted for provenance attestations).
# Auth via npm Trusted Publishing (OIDC). The package exists on npm
# as of v3.0.0-beta.3, so a trusted publisher can be configured for
# it on npmjs.com (Packages → @salishforge/memforge → Settings →
# Trusted publishing). Once configured, no NODE_AUTH_TOKEN is needed:
# npm CLI uses the GitHub Actions OIDC token (id-token: write, above)
# to authenticate directly.
- name: Publish package
run: npm publish --access public --provenance
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

github-release:
name: Create GitHub Release
Expand Down
Loading