From 7d303b7175367e445453fb1d6ede10bbf15f73cc Mon Sep 17 00:00:00 2001 From: DietrichGebert Date: Wed, 24 Jun 2026 02:58:03 +0200 Subject: [PATCH] ci: publish via npm trusted publishing (OIDC), drop NPM_TOKEN (#282) Authenticate the release workflow through GitHub OIDC instead of a long-lived npm token: no secret to leak or rotate, provenance attached automatically. Upgrade npm on the runner since OIDC publishing needs npm >= 11.5.1 (Node 22 ships npm 10). --- .github/workflows/publish.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e34331d..c249c4a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -17,7 +17,8 @@ jobs: - uses: actions/setup-node@v4 with: node-version: '22' - registry-url: 'https://registry.npmjs.org' - - run: npm publish --provenance --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 22 ships npm 10. + - run: npm install -g npm@latest + # No token: id-token: write above lets npm authenticate via OIDC, and + # provenance is attached automatically. access set in publishConfig. + - run: npm publish