From 434aa8fa390b6992477e391975f49447b31e212f Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Sun, 16 Aug 2026 16:43:18 +0200 Subject: [PATCH] ci: authenticate the first publish with the token, after all MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I removed this env block one PR ago in favour of trusted publishing, and that was the right destination reached in the wrong order: a trusted publisher is configured on a PACKAGE, and neither package exists yet. With the token wiring gone and OIDC not yet possible, a tag push would have failed to authenticate by either route. So the bootstrap release authenticates with NPM_TOKEN (now set correctly on this repo). Once the package exists on the registry, the trusted publisher is configured against this workflow, this env block goes away again, and the token is revoked — that ordering actually works. Node 24 stays: it is required for OIDC later and harmless now. Provenance is unaffected. `id-token: write` is what npm needs to attest the build, and that is independent of how the publish authenticates — so the bootstrap release still gets a real attestation rather than --provenance=false. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c63e70c..bd0f44e 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -38,7 +38,14 @@ jobs: exit 1 fi - # No token: id-token above lets the CLI exchange a short-lived OIDC - # credential with npm. Provenance is generated automatically for a public - # package from a public repo, so --provenance is not needed either. + # Bootstrap auth. Trusted publishing (OIDC) is the destination and needs no + # token, but it is configured on a PACKAGE — which cannot exist until it + # has been published once. So the first release authenticates with a token; + # once the package exists, the trusted publisher is configured, this env + # block is deleted, and the token is revoked. + # + # Provenance still works here: `id-token: write` above is what npm needs to + # attest the build, and that is independent of how the publish authenticates. - run: npm publish + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}