update: use oidc to publish to npm - #24
Merged
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The workflows may fail because npm publish --provenance can require a newer npm CLI than what’s guaranteed by the current Node 18 setup without explicitly upgrading npm (see PR comments).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the npm publishing pipelines for jwks-slim and ssm-env-util to use GitHub OIDC-based publishing with provenance, aligning releases with the intended “OIDC publish” approach referenced in the PR description.
Changes:
- Switch npm publish steps to
npm publish --provenanceand enableid-token: writein both publish workflows. - Update package metadata/versions (and add missing repository metadata for
ssm-env-util). - Correct
jwks-slimrepository/homepage URLs tofundwave/network-utils.
File summaries
| File | Description |
|---|---|
ssm-env-util/package.json |
Bumps version and adds repository metadata for npm package publishing. |
ssm-env-util/package-lock.json |
Updates lockfile version fields to match the new package version. |
jwks-slim/package.json |
Bumps version and corrects repository/homepage URLs. |
jwks-slim/package-lock.json |
Updates lockfile version fields to match the new package version. |
.github/workflows/npm-publish.yml |
Enables OIDC permissions and publishes with provenance. |
.github/workflows/npm-publish-ssm-env-util.yml |
Enables OIDC permissions and publishes with provenance. |
Review details
Files not reviewed (2)
- jwks-slim/package-lock.json: Generated file
- ssm-env-util/package-lock.json: Generated file
- Files reviewed: 4/6 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
giriparus
reviewed
Sep 7, 2026
Also trigger the workflow on changes to its own file.
Also trigger the workflow on changes to its own file.
giriparus
approved these changes
Sep 7, 2026
giriparus
left a comment
giriparus
left a comment
Contributor
There was a problem hiding this comment.
Reviewed workflow changes to push using oidc. lgtm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
updated jwks-slim and ssm-env-util package publishing to use oidc
Resolutions
Deployment
Current pipelines will suffice