From fe92526e4787fc338d8a022c899fecccb6a2714d Mon Sep 17 00:00:00 2001 From: nicosampler Date: Wed, 29 Jul 2026 15:03:54 -0300 Subject: [PATCH] ci: publish to npm via trusted publishing (OIDC) instead of token --- .changeset/tame-owls-shine.md | 2 ++ .github/workflows/release.yml | 11 +++++++---- 2 files changed, 9 insertions(+), 4 deletions(-) create mode 100644 .changeset/tame-owls-shine.md diff --git a/.changeset/tame-owls-shine.md b/.changeset/tame-owls-shine.md new file mode 100644 index 0000000..a845151 --- /dev/null +++ b/.changeset/tame-owls-shine.md @@ -0,0 +1,2 @@ +--- +--- diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 420e42c..989f63d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: permissions: contents: write # create tags / GitHub releases and push the Version Packages PR pull-requests: write # open and update the Version Packages PR - id-token: write # npm provenance (signed, verifiable publish origin) + id-token: write # npm trusted publishing (OIDC) and provenance steps: - uses: actions/checkout@v4 with: @@ -28,7 +28,12 @@ jobs: - uses: actions/setup-node@v4 with: node-version: 22 - registry-url: https://registry.npmjs.org # writes the auth line npm publish needs + + # Publishing uses npm trusted publishing (OIDC) — the trusted publisher is + # configured on npmjs.com for this repo/workflow, so no NPM_TOKEN is needed + # and provenance is attached automatically. It requires npm >= 11.5.1, + # while node 22 ships npm 10. + - run: npm install -g npm@latest - run: npm ci @@ -41,5 +46,3 @@ jobs: publish: npm run release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - NPM_CONFIG_PROVENANCE: "true" # attach provenance attestation on publish