Support Trusted Publishing

[jdgamble555]

You can have 2FA on if you have Trusted Publishing.

This should support trusted publishing as well.

J

[andrii-kravets-x]

This may be of interest to you:
https://github.com/withastro/astro/blob/ad3265daf8651c6e15243f5ba85165da5ca4652d/.github/workflows/release.yml#L47

[jdgamble555]

Thanks, actually found what I needed here. This should be updated in the main docs since this is going to be the new norm:

https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow

J

[ryanbas21]

I wrote #545 which should help. Basically if no npm_token is in the environment, dont append it to the npmrc file. that way its not required for passing in. if its required and not passed in npm publishing should fail

[tomwayson]

The above comments helped me get trusted publishing to work w/ this action, but I needed to do a little more.

Documenting the key changes here in case it helps others:

1. use NPM_TOKEN: '' so the action doesn't pass undefined as the token (may not be needed if fix: conditionally append NPM_TOKEN to .npmrc for trusted publishing … #545 gets merged)
2. add a step to my workflow that updates to npm >= 11.5.1 (as per https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow)
3. use NPM_CONFIG_PROVENANCE: false b/c we use hosted runners which do not support provenance

We already had the workflow configured w/ the id-token: write permission, but that is also required.

[mzvast]

The above comments helped me get trusted publishing to work w/ this action, but I needed to do a little more.

Documenting the key changes here in case it helps others:

1. use NPM_TOKEN: '' so the action doesn't pass undefined as the token (may not be needed if fix: conditionally append NPM_TOKEN to .npmrc for trusted publishing … #545 gets merged)
2. add a step to my workflow that updates to npm >= 11.5.1 (as per https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow)
3. use NPM_CONFIG_PROVENANCE: false b/c we use hosted runners which do not support provenance

We already had the workflow configured w/ the id-token: write permission, but that is also required.

realy helpful.

I got error when my npm version is lower so add like this works. Also can update node to 24 but it's more risky~

     - name: Setup node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: 'https://registry.npmjs.org'
          cache: "pnpm"

      - name: Update npm
        run: npm install -g npm@'>=11.5.1' // got a newer npom

[ksr20612]

i'm still struggling with it..
not working with NPM_TOKEN: '' & 'NPM_CONFIG_PROVENANCE: false

npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=779414736
npm notice Access token expired or revoked. Please try logging in again.

according to error logs, it seems that mine still uses Access Token.

[ryanbas21]

#545 was merged, hopefully when this is released it helps!

[wibjorn]

Even after removing NPM_TOKEN from both the repository secrets and setting the value to an empty string, I'm still seeing our release pipeline fall into the first case, logging the following in CI:

"Didn't find existing auth token for the npm registry in the user .npmrc file, creating one"`.

This is preventing control flow from reaching the place it needs to in the second condition.

Here's a link to the attempt, which fails to publish, in case I'm overlooking something obvious - as I see many links above that look very similar.

How would we feel about reversing the order of the conditions, to place trusted publishing first?

[andreadistefano]

@wibjorn I was seeing the same errors in my builds until I realized the latest released version (v1.6.0) doesn't have that if condition yet.
Hopefully the maintainers cut a new release soon enough 🙏🏻

In the meanwhile I switched to something like this (running pnpm publish is obviously not the same as the changeset publish we were using before but I needed to publish some new versions of our packages ASAP):

env:
 NPM_CONFIG_PROVENANCE: false

[...]

- name: Create Release Pull Request or Publish to npm
  id: changesets
  uses: changesets/action@v1
  with:
    commit: 'ci: release packages'
    title: 'ci: release packages'

- name: Publish packages
  if: ${{ steps.changesets.outputs.hasChangesets == 'false' }}
  run: pnpm -r publish --access public --no-git-checks