From 065ba1eef1f7477bffa2481a8abff376ef88b538 Mon Sep 17 00:00:00 2001 From: Mickael Kasinski Date: Thu, 16 Jul 2026 17:25:26 +0200 Subject: [PATCH] ci: publish to npm via OIDC trusted publishing Drop the long-lived NPM_TOKEN in favor of npm trusted publishing (OIDC), which @semantic-release/npm v13 supports via the id-token: write permission already granted to the job. This removes the recurring token-expiry failure mode and enables automatic provenance. Also upgrade npm in the runner to a version that supports trusted publishing (Node 22 still ships npm 10; OIDC needs >= 11.5.1). Requires a matching trusted publisher configured on the npm package. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7bc116b..5a00966 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,6 +26,10 @@ jobs: node-version: 22 cache: npm + # Trusted publishing (OIDC) requires npm >= 11.5.1; Node 22 still ships npm 10. + - name: Upgrade npm for trusted publishing + run: npm install -g npm@latest + - name: Install dependencies run: npm ci @@ -35,8 +39,9 @@ jobs: - name: Test run: npm test + # No NPM_TOKEN: @semantic-release/npm authenticates to npm via OIDC + # trusted publishing (needs id-token: write, granted above). - name: Release run: npx semantic-release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }}