From c635a025e8fbcf8e7cc1fbf143c596c045b63710 Mon Sep 17 00:00:00 2001 From: Suprhimp Date: Thu, 2 Jul 2026 14:44:52 +0900 Subject: [PATCH] ci: publish via npm Trusted Publishing (OIDC) Replace the NPM_TOKEN auth (blocked by npm's 2FA-for-publish policy, E403) with OIDC-based Trusted Publishing: - bump Node to 24 and upgrade npm to >= 11.5.1 (required for OIDC) - drop NPM_TOKEN / NODE_AUTH_TOKEN env from the changesets publish step Requires a Trusted Publisher configured on npmjs.com for Planningo/duul + release.yml. The id-token: write permission is already set. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4926411..eb3c0b0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,15 +25,22 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 24 registry-url: https://registry.npmjs.org + # Trusted Publishing (OIDC) requires npm >= 11.5.1. + - name: Upgrade npm + run: npm install -g npm@latest + - name: Install dependencies run: npm ci - name: Build run: npm run build + # Publishes via npm Trusted Publishing (OIDC) — no NPM_TOKEN required. + # Requires a Trusted Publisher configured on npmjs.com for this + # repo + workflow, plus the id-token: write permission above. - name: Create Release Pull Request or Publish id: changesets uses: changesets/action@v1 @@ -44,5 +51,3 @@ jobs: commit: "chore: release" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}