ci: migrate npm publishing to OIDC trusted publishing - #17
Merged
Conversation
Replace the long-lived NPM_TOKEN with npm OIDC trusted publishing, so releases no longer depend on a credential that npm now caps at a ≤90-day lifetime (the expired token just broke the 0.1.29 release). - release.yml: add `id-token: write` to the three npm publish jobs, bump pnpm/action-setup 9 -> 10 (pnpm gained OIDC publish support in 10.18), and drop `NODE_AUTH_TOKEN`. The MCP-registry job drops `--npm-token`; npm package ownership is verified via the public `mcpName` field. - package.json (orca-lang, runtime-ts, mcp-server): add `repository`, required for the provenance attestations trusted publishing generates. Requires a one-time Trusted Publisher config per package on npmjs.com (org=jascal, repo=orca-lang, workflow=release.yml) — already configured. NPM_TOKEN secret retained as rollback until the first OIDC release is verified green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reflect the migration in release.yml: npm now publishes via OIDC (no NPM_TOKEN), the MCP-registry job is token-less, and document the Trusted Publisher / repository-field / pnpm>=10.18 setup plus the rollback path. Removes the stale "npm publishing is broken / stuck at 0.1.27" note (npm latest is now 0.1.29). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Address PR #17 review: pin pnpm/action-setup to an exact version for reproducible publishes instead of floating on latest 10.x. 10.33.0 is the version validated locally against the v9.0 lockfile with --frozen-lockfile; it satisfies the >=10.18 requirement for pnpm OIDC trusted publishing. Inline comment documents the why. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add the CHANGELOG.md v0.1.30 entry (consumed by release.yml's GitHub-Release job) and hand-bump runtime-python __version__ to 0.1.30, which CI's version job does not sed (it only touches pyproject.toml + server.json). This keeps the train in lockstep once CI patch-bumps the npm packages on merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replace the long-lived
NPM_TOKENwith npm OIDC trusted publishing so releases stop depending on a credential that npm now caps at a ≤90-day lifetime.Context: the
v0.1.29release failed because theNPM_TOKENgranular token had expired (May 19) →E404on publish, then a re-minted token hitE403for missing the bypass-2FA flag. npm removed classic/automation tokens in Dec 2025 and caps granular write tokens at ≤90 days, so a token-based flow means this recurs every quarter. OIDC removes the token entirely.Changes
release.yml(the three npm jobs):permissions: { contents: read, id-token: write }(OIDC).pnpm/action-setup9 → 10(pnpm gained OIDC publish support in 10.18).NODE_AUTH_TOKENfrom thePublishsteps.--npm-token— npm ownership is verified via the publicmcpNamefield, so it's now token-less too.package.json(orca-lang,runtime-ts,mcp-server):repositoryfield — required for the provenance attestations trusted publishing auto-generates.CLAUDE.md: update the Release & Deployment section (npm is now token-less OIDC; remove the stale "publishing is broken / stuck at 0.1.27" note — npmlatestis0.1.29).secrets.NPM_TOKENis referenced nowhere in the workflow after this. PyPI (PYPI_TOKEN) and the Go tag (GO_MODULE_PAT) are untouched.Prerequisite — already done
Per-package Trusted Publisher configured on npmjs.com for all three packages (org=
jascal, repo=orca-lang, workflow=release.yml, allowed actionnpm publish).Validation
pnpm install --frozen-lockfilepasses on pnpm 10.33 → the v9.0 lockfile is compatible.release.ymlparses; all three npm jobs carryid-token: write; noNODE_AUTH_TOKEN/secrets.NPM_TOKENremain.package.jsonfiles parse and carryrepository.workflow_dispatchcan't exercise it — theif: refs/tags/vguard skips it, and the idempotency guard skips already-published versions).Rollback
Keep the
NPM_TOKENsecret until the first OIDC release is green. To revert: re-addNODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}to the threePublishsteps and pinpnpm/action-setupback to9.🤖 Generated with Claude Code