Switch to trusted publishing

[rublag-hs]

Note

Update the release workflow to use OIDC trusted publishing by granting id-token and removing the NODE_AUTH_TOKEN env from publish.

• CI/CD (GitHub Actions):
  • Update /.github/workflows/release.yaml to use trusted publishing for npm:
    • Add permissions: id-token: write.
    • Remove NODE_AUTH_TOKEN environment from the Publish step.

^{Written by Cursor Bugbot for commit 4580abc. This will update automatically on new commits. Configure here.}

[cursor]

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on December 26

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

Bug: pnpm may not support OIDC authentication for publishing

The NODE_AUTH_TOKEN environment variable has been removed without adding a replacement authentication mechanism. npm's trusted publishing via OIDC requires specific npm CLI support (10.9+), but pnpm publish may not implement the same OIDC token exchange flow. While id-token: write permission is set and actions/setup-node configures the registry URL, pnpm's publish command might not automatically request and use OIDC tokens like the npm CLI does, potentially causing authentication failures.

.github/workflows/release.yaml#L36-L39

aidbox-ts-sdk/.github/workflows/release.yaml

Lines 36 to 39 in 4580abc

	run: pnpm -r run --sort build
	- name: Publish
	run: |
	pnpm -r publish --tag ${{ github.event.inputs.dist_tag }} --publish-branch master

 

---