Conversation
There was a problem hiding this comment.
Pull request overview
This PR migrates the NPM publish workflow to use NPM's trusted publishing feature, which replaces manual token-based authentication with OIDC (OpenID Connect) authentication. This enhances security by eliminating the need to manage long-lived NPM tokens.
Changes:
- Added
id-token: writepermission to enable OIDC authentication - Updated
actions/setup-nodefrom v3 to v4 for trusted publishing support - Removed the
npm whoamidebug command and theNODE_AUTH_TOKENsecret usage
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - run: npm whoami; npm --ignore-scripts publish | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{secrets.npm_token}} | ||
| - run: npm --ignore-scripts publish |
There was a problem hiding this comment.
When using NPM trusted publishing with OIDC, it's recommended to add the --provenance flag to the publish command. This generates signed provenance attestations that provide verifiable information about how the package was built, enhancing supply chain security. Change this line to: npm --ignore-scripts publish --provenance
| - run: npm --ignore-scripts publish | |
| - run: npm --ignore-scripts publish --provenance |
|
|
||
| on: | ||
| release: | ||
| types: [created] |
There was a problem hiding this comment.
I think this will work now, but we might want to add another trigger here so we can manually run it
2 participants
Updates the publish workflow to use NPM's trusted publishing feature, which uses OIDC authentication instead of npm tokens.
Migration guide: https://docs.npmjs.com/trusted-publishers