From a27da5cc97cc922febbd872e6c014cc11897b2c0 Mon Sep 17 00:00:00 2001 From: JeongUk Park Date: Sat, 25 Jul 2026 22:04:28 +0900 Subject: [PATCH 1/3] =?UTF-8?q?ci:=20npm=20Trusted=20Publishing=EC=9C=BC?= =?UTF-8?q?=EB=A1=9C=20=EC=A0=84=ED=99=98=20(=ED=86=A0=ED=81=B0=20?= =?UTF-8?q?=EC=A0=9C=EA=B1=B0)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/publish.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 3482125..c0b4adc 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,24 +1,24 @@ name: publish -# GitHub Release를 publish하면 npm에 배포한다. NPM_TOKEN 시크릿 필요. +# GitHub Release를 publish하면 npm에 배포한다. +# 인증은 npm Trusted Publishing(OIDC) — 장기 토큰(NPM_TOKEN) 없이 단기 토큰으로 배포하며 +# provenance도 자동 생성된다. npm 쪽 패키지 설정에 이 저장소·워크플로가 등록돼 있어야 한다. on: release: types: [published] permissions: contents: read - id-token: write # npm provenance(OIDC)에 필요 + id-token: write # OIDC 토큰 발급에 필요 jobs: publish: - runs-on: ubuntu-latest + runs-on: ubuntu-latest # Trusted Publishing은 GitHub-hosted 러너만 지원 steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 24 # OIDC 요구: node 22.14+ / npm 11.5.1+ registry-url: https://registry.npmjs.org - run: npm ci - run: npm test - - run: npm publish --provenance - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + - run: npm publish From ae714eb495143c90c19ffae7558fb4772dfa95c4 Mon Sep 17 00:00:00 2001 From: JeongUk Park Date: Sun, 26 Jul 2026 10:39:07 +0900 Subject: [PATCH 2/3] =?UTF-8?q?fix:=20CodeRabbit=20=EB=B0=98=EC=98=81=20(c?= =?UTF-8?q?heckout=20=EC=9E=90=EA=B2=A9=EC=A6=9D=EB=AA=85=C2=B7npm=20?= =?UTF-8?q?=EC=B5=9C=EC=8B=A0=ED=99=94)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/publish.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c0b4adc..4f4089f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -15,10 +15,15 @@ jobs: runs-on: ubuntu-latest # Trusted Publishing은 GitHub-hosted 러너만 지원 steps: - uses: actions/checkout@v4 + with: + persist-credentials: false # 배포에 repo 자격증명이 필요 없다 — git config에 남기지 않는다 - uses: actions/setup-node@v4 with: node-version: 24 # OIDC 요구: node 22.14+ / npm 11.5.1+ registry-url: https://registry.npmjs.org + # setup-node가 .npmrc에 남기는 _authToken placeholder가 OIDC 인증과 충돌할 수 있어 + # npm을 최신으로 올려 Trusted Publishing 경로를 확실히 쓰게 한다 + - run: npm install -g npm@latest - run: npm ci - run: npm test - run: npm publish From d1af622f440e8140aa510d18182d797bd5914bde Mon Sep 17 00:00:00 2001 From: JeongUk Park Date: Sun, 26 Jul 2026 10:45:21 +0900 Subject: [PATCH 3/3] =?UTF-8?q?fix:=20npm=20=EB=B2=84=EC=A0=84=20=ED=95=80?= =?UTF-8?q?=C2=B7ignore-scripts=20(=EA=B3=B5=EA=B8=89=EB=A7=9D)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/publish.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 4f4089f..6413a74 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -22,8 +22,9 @@ jobs: node-version: 24 # OIDC 요구: node 22.14+ / npm 11.5.1+ registry-url: https://registry.npmjs.org # setup-node가 .npmrc에 남기는 _authToken placeholder가 OIDC 인증과 충돌할 수 있어 - # npm을 최신으로 올려 Trusted Publishing 경로를 확실히 쓰게 한다 - - run: npm install -g npm@latest + # Trusted Publishing을 지원하는 npm으로 고정한다(11.5.1+). id-token 권한이 있는 job이므로 + # 가변 태그(@latest) 대신 버전을 핀하고 설치 스크립트도 실행하지 않는다 + - run: npm install -g --ignore-scripts npm@11.8.0 - run: npm ci - run: npm test - run: npm publish