Migrate to NPM trusted publishing #82
Conversation
There was a problem hiding this comment.
Pull request overview
This PR migrates the NPM publish workflow to use NPM's trusted publishing feature, which replaces manual token-based authentication with OIDC (OpenID Connect) authentication. This enhances security by eliminating the need to manage long-lived NPM tokens.
Changes:
- Added
id-token: writepermission to enable OIDC authentication - Updated
actions/setup-nodefrom v3 to v4 for trusted publishing support - Removed the
npm whoamidebug command and theNODE_AUTH_TOKENsecret usage
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - run: npm whoami; npm --ignore-scripts publish | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{secrets.npm_token}} | ||
| - run: npm --ignore-scripts publish |
There was a problem hiding this comment.
When using NPM trusted publishing with OIDC, it's recommended to add the --provenance flag to the publish command. This generates signed provenance attestations that provide verifiable information about how the package was built, enhancing supply chain security. Change this line to: npm --ignore-scripts publish --provenance
| - run: npm --ignore-scripts publish | |
| - run: npm --ignore-scripts publish --provenance |
|
|
||
| on: | ||
| release: | ||
| types: [created] |
There was a problem hiding this comment.
I think this will work now, but we might want to add another trigger here so we can manually run it
Updates the publish workflow to use NPM's trusted publishing feature, which uses OIDC authentication instead of npm tokens.
Migration guide: https://docs.npmjs.com/trusted-publishers