From 9e15a0d969efa8bc1e43c4fb38fa1683efb8f0b6 Mon Sep 17 00:00:00 2001 From: Arne Luenser Date: Wed, 19 Aug 2026 19:21:48 +0200 Subject: [PATCH] ci: publish to npm via OIDC trusted publishing Replaces the NPM_TOKEN_AENEASR secret with OIDC trusted publishing: the job mints an id-token that npm exchanges for publish credentials, and each package attests provenance automatically. Requires npm >= 11.5.1, which node 22 does not bundle. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yaml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ba815963..8c054349 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -87,17 +87,22 @@ jobs: if: ${{ github.ref_type == 'tag' }} needs: - release + # Authenticates to npm via OIDC trusted publishing (no token). Each + # published package must list this repo and workflow file as a trusted + # publisher in its npmjs.com settings. + permissions: + id-token: write + contents: read steps: - uses: ory/ci/checkout@master - uses: actions/setup-node@v4 with: node-version: "22" + # Trusted publishing requires npm >= 11.5.1; node 22 bundles npm 10. + - run: npm install -g npm@11 - env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN_AENEASR }} REF_NAME: ${{ github.ref_name }} - run: | - echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc - node npm/publish.js "$REF_NAME" + run: node npm/publish.js "$REF_NAME" newsletter-draft: name: Draft newsletter