From e616d1000844130992cc9c35bf7b61673531fe5d Mon Sep 17 00:00:00 2001 From: EL JABIRI Tarik Date: Wed, 16 Sep 2026 00:07:18 +0100 Subject: [PATCH 1/2] ci: stage npm release for maintainer approval The trusted publisher is stage-only, so CI now runs npm stage publish instead of npm publish. A maintainer approves the staged release with 2FA (npm stage approve or the Staged Packages tab). --- .github/workflows/cd.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index cc77f42..7c8e4fd 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -23,9 +23,11 @@ jobs: - run: bun install --frozen-lockfile - run: bun run test - run: bun run build - - name: Publish to npm - # bun publish has no OIDC support yet, so publish with npm. - # No token: auth comes from the trusted publisher configured on npm. + - name: Stage release to npm + # bun publish has no OIDC support, so use npm. The trusted publisher is + # stage-only: this submits a staged release that a maintainer must then + # approve with 2FA (npm stage approve , or the Staged Packages tab + # on npmjs.com). No token: auth comes from OIDC. run: | npm install -g npm@latest - npm publish --provenance --access public + npm stage publish From 4b810d2b65afa99c4669941c81066326de77666d Mon Sep 17 00:00:00 2001 From: EL JABIRI Tarik Date: Wed, 16 Sep 2026 00:08:30 +0100 Subject: [PATCH 2/2] ci: remove comments from cd workflow --- .github/workflows/cd.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 7c8e4fd..5b7d296 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - id-token: write # required for npm OIDC trusted publishing + id-token: write steps: - uses: actions/checkout@v4 - uses: oven-sh/setup-bun@v2 @@ -24,10 +24,6 @@ jobs: - run: bun run test - run: bun run build - name: Stage release to npm - # bun publish has no OIDC support, so use npm. The trusted publisher is - # stage-only: this submits a staged release that a maintainer must then - # approve with 2FA (npm stage approve , or the Staged Packages tab - # on npmjs.com). No token: auth comes from OIDC. run: | npm install -g npm@latest npm stage publish