From e799eee5b430453588bb164a2269a5e2b9c38dc5 Mon Sep 17 00:00:00 2001 From: Bogdan Ivanov Date: Fri, 16 Oct 2026 16:21:03 +0300 Subject: [PATCH] ci: publish to npm via trusted publishing (OIDC) Replace the NPM_TOKEN secret with npm trusted publishing: grant the job id-token: write, move to Node 24 and upgrade npm to >= 11.5.1. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4733630..138fe56 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,16 +21,20 @@ jobs: publish-npm: name: Publish to npm runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 with: - node-version: 20 + node-version: 24 registry-url: https://registry.npmjs.org + # Trusted publishing (OIDC) requires npm >= 11.5.1 + - run: npm install -g npm@latest + - run: npm install - - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} \ No newline at end of file + - run: npm publish \ No newline at end of file