From 3fc582be3e05e9c1c71c129d65753d5b373ca24e Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Sun, 16 Aug 2026 15:48:20 +0200 Subject: [PATCH] ci: publish via OIDC, so no npm token has to exist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trusted publishing lets the workflow exchange a short-lived, workflow-scoped OIDC credential with npm at publish time. Nothing long-lived is stored, so there is no secret to leak, rotate, or accidentally paste somewhere it becomes visible. That last one is not hypothetical: an npm token was created for this repo today and ended up as a GitHub Actions secret *name* rather than its value — and names are visible metadata, not secrets. The token has been revoked. This change removes the reason to ever create another one. Two things the workflow would have failed on, from the npm docs: - Node 22 bundles npm 10.x, but trusted publishing requires npm >= 11.5.1. Node 24 ships npm 11, so the runtime is bumped rather than adding a separate npm upgrade step. - `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` passed an empty string once the secret was gone. The documented OIDC example sets no token at all — the `id-token: write` permission already present is what does the work. Provenance also stops needing the flag: npm generates attestations automatically for a public package published from a public repo via OIDC. Still required on the npm side, and not verified until the first publish attempt (npm does not validate the config when saved): the trusted publisher must name this repo and `publish.yml` exactly, and package.json's repository.url must match the GitHub repo — it does. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f78236a..c63e70c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -18,7 +18,8 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: '22' + # npm >= 11.5.1 is required for trusted publishing (OIDC); Node 24 ships it. + node-version: '24' registry-url: 'https://registry.npmjs.org' - run: npm ci --ignore-scripts @@ -37,6 +38,7 @@ jobs: exit 1 fi + # No token: id-token above lets the CLI exchange a short-lived OIDC + # credential with npm. Provenance is generated automatically for a public + # package from a public repo, so --provenance is not needed either. - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}