From 97cc982c306ddc7d7d1ab0eae2a4cbbbea4df7d0 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 11 Nov 2026 23:11:22 +0000 Subject: [PATCH] ci: publish to npm with trusted publishing instead of a token The package now has a trusted publisher on npmjs.com for this workflow, so npm verifies the run through GitHub's OIDC token (id-token: write) and NPM_TOKEN is no longer needed. The previous token had expired, and direct publishing with granular tokens that bypass 2FA ends in January 2027. The current Node LTS ships npm 11.20, above the 11.5.1 that trusted publishing needs. The same change already published @moulibheemaneti/docfold 0.1.1 through trusted publishing. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Ewn3bYVbsq8jq7B4eP2C47 --- .github/workflows/publish.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 4cb5a60..33e980e 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,14 +9,14 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - id-token: write # required for npm provenance + id-token: write # lets npm trusted publishing verify this workflow (and sign provenance) steps: - uses: actions/checkout@v4 - name: Setup Bun uses: oven-sh/setup-bun@v2 - # setup-node is required so npm can pick up NODE_AUTH_TOKEN for registry auth + # Trusted publishing needs npm 11.5.1 or newer; the current Node LTS ships with it. - name: Setup Node.js uses: actions/setup-node@v4 with: @@ -29,9 +29,7 @@ jobs: - name: Build run: bun run build + # No token: npm trusts this workflow through trusted publishing, set up on npmjs.com under + # the package's Settings → Trusted publishing (GitHub Actions, moulibheemaneti/commitguard, publish.yml). - name: Publish to npm run: npm publish --provenance --access public - env: - # NPM_TOKEN: generate an Automation token at npmjs.com → Profile → Access Tokens, - # then add it as a repository secret at Settings → Secrets and variables → Actions. - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}