From 68088452e0f8720f89d49b0a2692123b0ba5a874 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 11 Nov 2026 22:58:13 +0000 Subject: [PATCH] ci: publish to npm with trusted publishing instead of a token The package now has a trusted publisher on npmjs.com for this workflow, so npm verifies the run through GitHub's OIDC token (id-token: write) and NPM_TOKEN is no longer needed. Direct publishing with granular tokens that bypass 2FA ends in January 2027, and the tokens expire within 90 days. The current Node LTS ships npm 11.20, above the 11.5.1 that trusted publishing needs. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Ewn3bYVbsq8jq7B4eP2C47 --- .github/workflows/publish.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a3694eb..b73d9af 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,14 +9,14 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - id-token: write # required for npm provenance + id-token: write # lets npm trusted publishing verify this workflow (and sign provenance) steps: - uses: actions/checkout@v4 - name: Setup Bun uses: oven-sh/setup-bun@v2 - # setup-node is required so npm can pick up NODE_AUTH_TOKEN for registry auth + # Trusted publishing needs npm 11.5.1 or newer; the current Node LTS ships with it. - name: Setup Node.js uses: actions/setup-node@v4 with: @@ -34,9 +34,7 @@ jobs: - name: Test run: bun test + # No token: npm trusts this workflow through trusted publishing, set up on npmjs.com under + # the package's Settings → Trusted publishing (GitHub Actions, moulibheemaneti/docfold, publish.yml). - name: Publish to npm run: npm publish --provenance --access public - env: - # NPM_TOKEN: generate an Automation token at npmjs.com → Profile → Access Tokens, - # then add it as a repository secret at Settings → Secrets and variables → Actions. - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}