From a8d3f3a404e31396d66f08e13266f6926e0159fb Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Sun, 16 Aug 2026 15:49:21 +0200 Subject: [PATCH] ci: publish via OIDC, so no npm token has to exist MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The publish workflow added yesterday needed an NPM_TOKEN secret. Trusted publishing removes that requirement entirely: the workflow exchanges a short-lived, workflow-scoped OIDC credential with npm at publish time, so nothing long-lived is stored and there is no secret to leak or rotate. Two things this workflow would have failed on, from the npm docs: - Node 22 bundles npm 10.x, but trusted publishing requires npm >= 11.5.1. Node 24 ships npm 11, so the runtime is bumped rather than adding a separate npm upgrade step. - `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` passed an empty string with no secret set. The documented OIDC example sets no token at all — the `id-token: write` permission already present is what does the work. Provenance stops needing the flag: npm generates attestations automatically for a public package published from a public repo via OIDC. Matches the identical change in ai-forms, so the two libraries keep releasing the same way. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f78236a..c63e70c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -18,7 +18,8 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: '22' + # npm >= 11.5.1 is required for trusted publishing (OIDC); Node 24 ships it. + node-version: '24' registry-url: 'https://registry.npmjs.org' - run: npm ci --ignore-scripts @@ -37,6 +38,7 @@ jobs: exit 1 fi + # No token: id-token above lets the CLI exchange a short-lived OIDC + # credential with npm. Provenance is generated automatically for a public + # package from a public repo, so --provenance is not needed either. - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}