From a035b82394031cf7eda73aac33434df74f3a0b30 Mon Sep 17 00:00:00 2001 From: 1bcMax Date: Tue, 20 Oct 2026 14:24:15 -0500 Subject: [PATCH] ci(publish): npm >= 11.5.1 for trusted publishing (OIDC) With the package's Trusted Publisher pointed at this repo's publish.yml on npmjs.com, npm exchanges the job's id-token for a one-off publish credential, so publishing stops depending on a long-lived NPM_TOKEN (npm is restricting 2FA-bypass tokens). NODE_AUTH_TOKEN stays as the fallback until every package is switched. --- .github/workflows/publish.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 15a56db5..8a42935a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -38,6 +38,13 @@ jobs: echo "already_published=false" >> "$GITHUB_OUTPUT" fi + # npm trusted publishing (OIDC): with this package's Trusted Publisher set + # to this repo + publish.yml on npmjs.com, npm >= 11.5.1 exchanges the + # job's id-token for a one-off publish credential, so no long-lived + # NPM_TOKEN is needed. The token stays below as a fallback until every + # package is switched over. + - name: Upgrade npm for trusted publishing + run: npm install -g npm@^11.5.1 - name: Publish to npm if: steps.check.outputs.already_published != 'true' run: npm publish --provenance --access public