ci: publish to npm via trusted publishing instead of a token - #4
Merged
Merged
Conversation
The release after #1 failed with "Not authenticated with npm". The NPM_TOKEN secret was set the same day 0.1.1 shipped and npm granular tokens cap at 90 days, so it had expired. Switches npmjs publishing to OIDC trusted publishing so there is no long-lived credential to expire again: - Drop the ~/.npmrc token write and the NPM_TOKEN env var. The id-token: write permission the workflow already had is what authenticates now. - Bump the pinned Node from 24.3.0 to 24.19.0. Trusted publishing needs npm >=11.5.1; 24.3.0 ships 11.4.2, 24.19.0 ships 11.17.0. - Set npm.skipChecks in .release-it.json. release-it runs `npm whoami` before publishing, which has no token to answer with under OIDC and would fail identically. - Drop --provenance from publishArgs; trusted publishing generates provenance automatically. The GitHub Packages step is untouched — it authenticates with GITHUB_TOKEN against a different registry. Requires a Trusted Publisher to be configured on npmjs.com for ElysiumOSS/ui-capture pointing at release.yml.
This was referenced Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Checklist
status: accepting prsOverview
The release triggered by merging #1 failed with
ERROR Not authenticated with npm, solaunchArgsis merged but unpublished. Replaces the expiring token with OIDC trusted publishing.NPM_TOKENwritten to~/.npmrcid-token: write24.3.0→ npm 11.4.224.19.0→ npm 11.17.0release-itnpm checksnpm whoaminpm.skipChecks)--provenanceflagGITHUB_TOKENWhy each piece
24.3.0ships npm 11.4.2, just under the minimum.24.5.0is the first v24 to clear it;24.19.0is current LTS. This is in.github/actions/prepare, so it lifts every CI job, not just release.npm.skipChecks— the easy thing to miss. release-it's npm plugin runsnpm whoamias a pre-flight check. Under OIDC there is no token for it to answer with, so without this the job fails with the same error message even after the token is gone, which would look like the migration didn't work.--provenance— npm generates provenance automatically for trusted publishes from public repos.publishConfig.provenance: truestays as a statement of intent.Requires a manual step before merge
npm can't be configured from CI. On npmjs.com →
@elysiumoss/ui-capture→ Settings → Trusted Publisher → GitHub Actions:ElysiumOSSui-capturerelease.ymlAll fields are case-sensitive, and npm does not validate them on save — a typo only surfaces as
ENEEDAUTHat publish time.Verification
Both YAML files parse;
.release-it.jsonis valid and Biome-clean. The real test is the publish itself, which can only run post-merge onmain— if the trusted publisher config has a typo it will fail withENEEDAUTHrather than the currentNot authenticated.Follow-up
Once a release goes out green, the
NPM_TOKENrepo secret and the corresponding npm token can both be deleted.