From 2ae90b15432e9cacf0d40f200cd357a868ab2703 Mon Sep 17 00:00:00 2001 From: dangreen Date: Sat, 5 Sep 2026 19:13:17 +0400 Subject: [PATCH] ci: publish through npm trusted publishing The release job authenticates with the npm registry through GitHub's OIDC token instead of the `NPM_TOKEN` secret: `id-token: write` on the job, no `registry-url` in `actions/setup-node`, no `NODE_AUTH_TOKEN`, and Node.js 24 for the npm CLI 11.5.1+ that trusted publishing needs. The explicit `permissions` block also keeps `contents: write` and `pull-requests: write`, which the pull request and release flows of the job use. Provenance attestations come with it. Requires the trusted publisher to be registered for every published package on npmjs.com: repository `TrigenSoftware/simple-release`, workflow `release.yml`. --- .github/workflows/release.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ebda384..ad9e533 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,6 +57,10 @@ jobs: name: Release needs: check if: needs.check.outputs.continue == 'true' + permissions: + contents: write + pull-requests: write + id-token: write steps: - name: Checkout the repository uses: actions/checkout@v7 @@ -67,13 +71,11 @@ jobs: - name: Install Node.js uses: actions/setup-node@v7 with: - node-version: 22 + node-version: 24 cache: 'pnpm' - registry-url: 'https://registry.npmjs.org' - name: Install dependencies run: pnpm install - name: Simple release run: pnpm tsm --no-warnings ./packages/ci/src/action.ts env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}