From 77e9aa9b3701a55da7cb0e1a306576d99f438aa8 Mon Sep 17 00:00:00 2001 From: Gandalf the Greybeard Date: Thu, 23 Apr 2026 16:10:39 +0000 Subject: [PATCH] ci: switch npm publish to OIDC trusted publishing Replaces NPM_TOKEN secret with id-token: write + --provenance so publishing uses GitHub's OIDC token directly. No repository secret required; provenance attestation is generated automatically. Also collapses the redundant second setup-node step (registry-url is now set on the first one). Co-Authored-By: Paperclip --- .github/workflows/ci.yml | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c51c48b..37b8fbe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,24 +29,21 @@ jobs: needs: test runs-on: ubuntu-latest if: github.ref == 'refs/heads/master' && github.event_name == 'push' + permissions: + id-token: write steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: "22" + registry-url: "https://registry.npmjs.org" cache: "npm" - run: npm ci - run: npm run build - - uses: actions/setup-node@v4 - with: - node-version: "22" - registry-url: "https://registry.npmjs.org" - cache: "npm" - - name: Publish (skip if version already exists) run: | PKG_NAME=$(node -p "require('./package.json').name") @@ -54,7 +51,5 @@ jobs: if npm view "${PKG_NAME}@${PKG_VERSION}" version 2>/dev/null; then echo "Version ${PKG_VERSION} already published — skipping." else - npm publish --access public + npm publish --provenance --access public fi - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}