Switch npm publish to OIDC trusted publishing#33
Merged
Conversation
Replaces the long-lived NODE_AUTH_TOKEN with GitHub's OIDC flow now that the repo is registered as a trusted publisher on npm. The previous v3.0.0 release attempt failed with E404 because the secret token had expired. - Add `permissions: id-token: write` so GitHub mints an OIDC token for the publish step. - Bump publish job to Node 24 (npm 11.5+) — trusted publishing requires npm >= 11.5.1, and Node 22 still ships with npm 10.x. - Drop `NODE_AUTH_TOKEN`; npm picks up the OIDC token automatically and produces provenance attestations by default. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Matches the publish-npm bump in the previous commit so both jobs in the release workflow run on the same Node version. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NODE_AUTH_TOKENwith GitHub's OIDC flow now that the repo is registered as a trusted publisher on npm. The v3.0.0 release attempt failed withnpm error 404 Not Found - PUT https://registry.npmjs.org/cacheablesbecause the long-lived token was no longer valid.permissions: id-token: writeon thepublish-npmjob so GitHub mints an OIDC token for the publish step.NODE_AUTH_TOKENenv. npm picks up the OIDC token automatically and produces provenance attestations by default.The
buildjob stays on Node 22 (matchesci.yml); only the publish step needed the bump.Test plan
publish-npmsucceeds.cacheables@3.0.0tarball on npmjs.com shows a provenance badge.npm_tokenrepo secret.🤖 Generated with Claude Code