Publish by OIDC trusted publishing instead of the expired npm token - #56

Merged

unbraind merged 23 commits into

mainfrom

ci/publish-by-oidc-trusted-publishing

Aug 27, 2026

Commits on Aug 26, 2026

Publish by OIDC trusted publishing instead of a stored npm token
unbraind
committed
9081191
Fail closed on the npm version actually in use, and scope the guards structurally
unbraind
committed
991ef8f
Fail the release before it bumps when npm refuses the workflow's identity
unbraind
committed
999fc52
Reject npm credential aliases and the --global install spelling
unbraind
committed
f186661
Close two guards that passed without the behaviour they protect
unbraind
committed
8f8d83e
Restore the docstring the guard suite's docstring gate requires
unbraind
committed
70458cd
Do not let the OIDC exchange credential outlive the step that fetched it
unbraind
committed
c44ab3e
Record the release-hardening evidence on the tracked item
unbraind
committed
f7e25f1
Encode the package name and accept 201, or the preflight blocks correct releases
unbraind
committed
91c153d
Scrub every legacy credential, bound the preflight, and name a registry outage
unbraind
committed
08eb49f
State the incident dates in these records as UTC
unbraind
committed
2ddcc5e
Refuse a non-main ref before requesting a publish credential
unbraind
committed
ac6a3d2
Gate the job by ref, re-verify npm at publish time, and make failures reachable
unbraind
committed
ec6242e

Commits on Aug 27, 2026