From 03ac935f7fa86da88d86b05a9db89be40f7315c7 Mon Sep 17 00:00:00 2001 From: Ivan Matveev Date: Sat, 30 May 2026 20:39:33 +0200 Subject: [PATCH] ci: use npm trusted publishing --- .github/workflows/publish.yml | 1 - README.md | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 78fe8ff..5fe6d67 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -37,4 +37,3 @@ jobs: title: "chore: version packages" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/README.md b/README.md index 0edce78..c826c81 100644 --- a/README.md +++ b/README.md @@ -254,7 +254,7 @@ npm run version-packages npm run publish-packages ``` -The workflow publishes with the `NPM_TOKEN` repository secret. Use npm trusted publishing later if you want tokenless provenance publishing. +The workflow uses npm trusted publishing through GitHub Actions OIDC. Local release commands are still available when needed: @@ -263,7 +263,7 @@ npm run ci npm run local-release ``` -GitHub Actions needs `NPM_TOKEN` as a repository secret, or npm trusted publishing configured for `.github/workflows/publish.yml`. +GitHub Actions needs npm trusted publishing configured for `.github/workflows/publish.yml`. ---