From d0618b2e285148e40c58371e2da9527d63b929fd Mon Sep 17 00:00:00 2001 From: Erik Hofer Date: Wed, 2 Sep 2026 15:48:23 +0200 Subject: [PATCH] CI: publish to npm via Trusted Publishing (OIDC) Replaces the npm_token secret with OIDC authentication: - adds the required id-token: write permission - upgrades npm, since trusted publishing needs npm >= 11.5.1 - drops NODE_AUTH_TOKEN; provenance is now attached automatically Co-Authored-By: Claude Opus 5 --- .github/workflows/npm-publish.yml | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index a6c6d94..f97f266 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -1,5 +1,7 @@ -# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created -# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages +# Publishes the package to the npm registry when a release is created. +# Authentication uses npm Trusted Publishing (OIDC) - no token secret required. +# The trusted publisher on npmjs.com is configured against this file name, +# so do not rename this workflow. name: NPM Package @@ -7,6 +9,10 @@ on: release: types: [created] +permissions: + contents: read + id-token: write # required for OIDC + jobs: publish-npm: runs-on: ubuntu-latest @@ -16,8 +22,9 @@ jobs: with: node-version: 24 registry-url: https://registry.npmjs.org/ + # Trusted publishing requires npm >= 11.5.1; the bundled npm may be older + - run: npm install -g npm@latest - run: npm ci - - run: npm run build + - run: npm run build + # No NODE_AUTH_TOKEN: OIDC authenticates, and provenance is attached automatically - run: npm publish - env: - NODE_AUTH_TOKEN: ${{secrets.npm_token}}