Skip to content

Upgrade Lerna to v9 and migrate npm publishing to Trusted Publishing#236

Open
Bhaswati1148 wants to merge 14 commits into
masterfrom
debug-npm-auth
Open

Upgrade Lerna to v9 and migrate npm publishing to Trusted Publishing#236
Bhaswati1148 wants to merge 14 commits into
masterfrom
debug-npm-auth

Conversation

@Bhaswati1148

@Bhaswati1148 Bhaswati1148 commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Description

This PR upgrades Lerna from v8 to v9, updates the GitHub Actions build and publish workflows to use Node.js 24.x, and migrates npm package publishing to npm Trusted Publishing.
It also removes the unused UOWS client generator package from the repo, as we now generate the UOWS client in the user-office-core itself

Motivation and Context

Our GitHub Actions workflow was unable to publish new package versions to the npm registry due to authentication failures related to the npm access token used by the publishing process. Please check the failed github action here

As part of investigating the issue, we attempted to generate a new npm access token using the STFC service account. During this process, npm recommended migrating to Trusted Publishers, which uses GitHub's OIDC-based authentication mechanism instead of long-lived or periodically rotated access tokens. This approach provides a more secure and maintainable solution for package publishing.

Support for npm Trusted Publishing was introduced in Lerna v9. Since our current version (v8) does not support this publishing mechanism, upgrading Lerna is required to enable OIDC-based authentication and publishing from GitHub Actions.

How Has This Been Tested

The GitHub Actions publishing workflow was executed from the debug-npm-auth branch after configuring npm Trusted Publishing and upgrading Lerna to v9.

The workflow completed successfully and was able to publish version 1.9.1 of the @user-office-software/duo-message-broker package to the npm registry using OIDC-based authentication.
Reference : successful github actions workflow run

Fixes

Changes

Depends on

Tests included/Docs Updated?

  • I have added tests to cover my changes.
  • All relevant doc has been updated

@Bhaswati1148 Bhaswati1148 changed the title Debug npm auth Upgrade Lerna to v9 and migrate npm publishing to Trusted Publishing Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant