From 070e03b7e7c25034a2d916bae59f3a03bfb3b0f5 Mon Sep 17 00:00:00 2001 From: Joseph Dale Banares Date: Fri, 2 Oct 2026 14:35:52 +0800 Subject: [PATCH] ci: publish to npm with trusted publishing instead of a token --- .github/workflows/ci.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 76e27fe..c8a49cc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -141,7 +141,7 @@ jobs: contents: write # tags and the GitHub release issues: write # release comments on issues pull-requests: write # and on pull requests - id-token: write # npm provenance + id-token: write # npm trusted publishing (OIDC) and provenance steps: # The deploy key pushes the release commit and the back-merge past branch protection. - uses: actions/checkout@v4 @@ -155,13 +155,14 @@ jobs: with: node-version: 24 registry-url: https://registry.npmjs.org + # Trusted publishing needs npm 11.5.1+, newer than some Node 24 images bundle. + - run: npm install -g npm@^11.5.1 - run: bun install --frozen-lockfile # The CLI's prepack bundles the viewer template, which this fresh checkout hasn't built yet. - run: bun run build - run: npx --no-install semantic-release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} GIT_AUTHOR_NAME: github-actions[bot] GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com GIT_COMMITTER_NAME: github-actions[bot]