From 03dfce7cb3cc12aeb1f00bb1706ccf29fd1d7bee Mon Sep 17 00:00:00 2001 From: Akshat Date: Wed, 19 Aug 2026 14:44:54 +0530 Subject: [PATCH] ci(publish): switch to npm Trusted Publishing (OIDC), drop NPM_TOKEN The granular access token approach failed: npm publish returned 403 ("You may not perform that action with these credentials") even with Bypass 2FA enabled and Read+write scoped to just this package. npm has removed Classic token creation for this account, and their own direction is clearly Trusted Publishing (OIDC) now -- no token/secret to store, leak, or expire. - node-version bumped 20 -> 22 (Trusted Publishing needs npm CLI >=11.5.1, which needs Node >=22.14) - dropped the NODE_AUTH_TOKEN env var / NPM_TOKEN secret entirely; npm CLI auto-detects the OIDC context from id-token: write (already present) Requires linking this repo + publish.yml under this package's Settings > Trusted publishing on npmjs.com before it will work. --- .github/workflows/publish.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c92d452..3bfdf8d 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -8,7 +8,7 @@ on: permissions: contents: read - id-token: write # required for npm provenance (Sigstore-signed build attestation) + id-token: write # required for npm Trusted Publishing (OIDC) + provenance jobs: publish: @@ -20,7 +20,7 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 22 # Trusted Publishing needs npm CLI >=11.5.1, which needs Node >=22.14 registry-url: 'https://registry.npmjs.org' - name: Install Dependencies @@ -38,7 +38,10 @@ jobs: exit 1 fi + # Auth is via npm Trusted Publishing (OIDC) -- configured on npmjs.com under + # this package's Settings > Trusted publishing, linked to this exact repo + + # workflow filename. No token/secret needed; npm CLI exchanges the GitHub + # OIDC token (from id-token: write above) for a short-lived publish token + # automatically. - name: Publish (with provenance) run: npm publish --provenance --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}