Skip to content

ci: publish to npm with trusted publishing instead of a token #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyamero merged 1 commit into from
Oct 2, 2026
Merged

ci: publish to npm with trusted publishing instead of a token #37

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ jobs:
contents: write # tags and the GitHub release
issues: write # release comments on issues
pull-requests: write # and on pull requests
id-token: write # npm provenance
id-token: write # npm trusted publishing (OIDC) and provenance
steps:
# The deploy key pushes the release commit and the back-merge past branch protection.
- uses: actions/checkout@v4
Expand All @@ -155,13 +155,14 @@ jobs:
with:
node-version: 24
registry-url: https://registry.npmjs.org
# Trusted publishing needs npm 11.5.1+, newer than some Node 24 images bundle.
- run: npm install -g npm@^11.5.1
- run: bun install --frozen-lockfile
# The CLI's prepack bundles the viewer template, which this fresh checkout hasn't built yet.
- run: bun run build
- run: npx --no-install semantic-release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
GIT_AUTHOR_NAME: github-actions[bot]
GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
GIT_COMMITTER_NAME: github-actions[bot]
Expand Down
Loading