Repository navigation
Publish npm packages via npm Trusted Publishing (no NPM_TOKEN) - #28
Merged
Merged
Conversation
- publish-npm authenticates via GitHub OIDC (id-token: write) instead of the expired NPM_TOKEN secret; Node 22 + npm 11 (trusted publishing needs npm >= 11.5.1); provenance attestations come automatically - explicit --tag latest (npm 11 requires a tag for prerelease versions) - workflow_dispatch with a ref input re-publishes npm only, from a release tag, without re-running the Maven/PyPI jobs Signed-off-by: Rohit Kumar <rrohit.ramsen@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The npm job of the v0.4.0-alpha release failed with
E404on publish because theNPM_TOKENsecret (last set April 2026) has expired. This PR switches npm publishing to npm Trusted Publishing, so no npm token is needed.Changes (
.github/workflows/publish.yml)publish-npmgetsid-token: write. npm verifies the GitHub OIDC token against each package's trusted-publisher settings (AgentTel/agenttel-sdk,publish.yml).NODE_AUTH_TOKEN.--tag latestexplicitly, because npm 11 requires a tag when publishing prerelease versions.workflow_dispatchtrigger with arefinput that publishes npm only, using the code at a release tag. This lets 0.4.0 go out to npm without a new release; the Java and Python jobs are skipped on manual runs.Before merging
@agenttel/nodeand@agenttel/types: GitHub Actions,AgentTel/agenttel-sdk,publish.yml, no environment.NPM_TOKENsecret.After merging
Run Publish manually (Actions → Publish → Run workflow) from
mainwithref = v0.4.0-alpha. That publishes@agenttel/types@0.4.0-alpha.0and@agenttel/node@0.4.0-alpha.0from the release commitde83b6a.actionlintreports no problems.