From 049b0b9524c7e34dcc8699ae5565bbeb747c95b2 Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Thu, 20 Aug 2026 18:30:08 -0400 Subject: [PATCH] ci: publish to npm via trusted publishing instead of a token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release after #1 failed with "Not authenticated with npm". The NPM_TOKEN secret was set the same day 0.1.1 shipped and npm granular tokens cap at 90 days, so it had expired. Switches npmjs publishing to OIDC trusted publishing so there is no long-lived credential to expire again: - Drop the ~/.npmrc token write and the NPM_TOKEN env var. The id-token: write permission the workflow already had is what authenticates now. - Bump the pinned Node from 24.3.0 to 24.19.0. Trusted publishing needs npm >=11.5.1; 24.3.0 ships 11.4.2, 24.19.0 ships 11.17.0. - Set npm.skipChecks in .release-it.json. release-it runs `npm whoami` before publishing, which has no token to answer with under OIDC and would fail identically. - Drop --provenance from publishArgs; trusted publishing generates provenance automatically. The GitHub Packages step is untouched — it authenticates with GITHUB_TOKEN against a different registry. Requires a Trusted Publisher to be configured on npmjs.com for ElysiumOSS/ui-capture pointing at release.yml. --- .github/actions/prepare/action.yml | 3 ++- .github/workflows/release.yml | 9 +++++---- .release-it.json | 2 +- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/actions/prepare/action.yml b/.github/actions/prepare/action.yml index e46d636..5e0315b 100644 --- a/.github/actions/prepare/action.yml +++ b/.github/actions/prepare/action.yml @@ -9,7 +9,8 @@ runs: bun-version: latest - uses: actions/setup-node@v4 with: - node-version: 24.3.0 + # >=24.5.0 for npm >=11.5.1, the minimum for npm trusted publishing. + node-version: 24.19.0 - run: bun install --frozen-lockfile shell: bash using: composite diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 50f877b..6af6dd5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,13 +20,14 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - uses: ./.github/actions/prepare - run: bun run build - - name: Set up npm auth - run: | - echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc + # Publishes to npmjs via trusted publishing (OIDC) — no NPM_TOKEN. The + # `id-token: write` permission below is what makes it work, and npm must + # have a Trusted Publisher configured for this repo pointing at + # `release.yml`. Provenance is generated automatically, so `.release-it.json` + # does not pass `--provenance`. - uses: JoshuaKGoldberg/release-it-action@v0.3.2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish to GitHub Packages env: NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.release-it.json b/.release-it.json index 2f00399..b270ba7 100644 --- a/.release-it.json +++ b/.release-it.json @@ -4,7 +4,7 @@ "requireCommits": true }, "github": { "release": true, "releaseName": "v${version}" }, - "npm": { "publishArgs": ["--access public", "--provenance"] }, + "npm": { "publishArgs": ["--access public"], "skipChecks": true }, "plugins": { "@release-it/conventional-changelog": { "infile": "CHANGELOG.md",