From 1f36e3e17f35ad94a6ee0b0eeb022e3eb8e7d02d Mon Sep 17 00:00:00 2001 From: Ben Date: Wed, 29 Jul 2026 15:37:12 +0000 Subject: [PATCH] ci(release): switch npm publishing to trusted publishing (OIDC) Grant the publish job id-token: write, upgrade to an npm CLI version that supports the OIDC exchange, and remove the legacy NPM_TOKEN authentication so npm publish uses trusted publishing. npm whoami cannot authenticate via OIDC, and setting NODE_AUTH_TOKEN would make npm skip the OIDC exchange entirely. Requires trusted publishers configured on npmjs.com for hunkdiff and the five hunkdiff-* platform packages (workflow release-prebuilt-npm.yml, environment npm). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01BerkCKcoCgvaKozTXXv6D8 --- .github/workflows/release-prebuilt-npm.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release-prebuilt-npm.yml b/.github/workflows/release-prebuilt-npm.yml index 6077f0a7f..2253c511e 100644 --- a/.github/workflows/release-prebuilt-npm.yml +++ b/.github/workflows/release-prebuilt-npm.yml @@ -191,6 +191,9 @@ jobs: - stage-release if: github.event_name == 'push' || inputs.publish == true environment: npm + permissions: + contents: read + id-token: write steps: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -206,6 +209,9 @@ jobs: node-version: 22 registry-url: https://registry.npmjs.org + - name: Use npm with trusted publishing support + run: npm install -g npm@11.17.0 + - name: Install dependencies run: bun install --frozen-lockfile @@ -218,14 +224,7 @@ jobs: - name: Show staged packages run: find dist/release/npm -maxdepth 3 -type f | sort - - name: Verify npm auth - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - run: npm whoami - - name: Publish packages - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} run: bun run publish:prebuilt:npm -- --tag "${{ github.event_name == 'workflow_dispatch' && inputs.npm_tag || ((contains(github.ref_name, '-alpha') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-rc')) && 'beta' || 'latest') }}" create-github-release: