Repository navigation
ci: publish to npm and PyPI via trusted publishing (OIDC) instead of tokens - #85
Merged
Merged
Conversation
…tokens Switch the release workflow off long-lived registry credentials and onto OIDC trusted publishing for both registries, configured the projen way: - npmTrustedPublishing: true -> npm job drops NPM_TOKEN, sets NPM_TRUSTED_PUBLISHER and keeps provenance via id-token: write. - publishToPypi.trustedPublishing: true -> PyPI job drops TWINE_USERNAME and TWINE_PASSWORD, gains id-token: write and PYPI_TRUSTED_PUBLISHER. Both jobs now authenticate with short-lived GitHub OIDC tokens exchanged by publib, removing the expiring NPM_TOKEN / TWINE_PASSWORD secrets that caused the 0.2.0 release to fail npm (404 on PUT) and PyPI (403 Forbidden). The trusted publishers must be registered once on npmjs.com and pypi.org before the next release.
mbonig
approved these changes
Oct 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue # (if applicable)
N/A — fixes the failing publish jobs on the
releaseworkflow (npm 404 on PUT, PyPI 403 Forbidden) caused by expired registry secrets.Reason for this change
The
releaseworkflow authenticates to npm with a long-livedNPM_TOKENand to PyPI withTWINE_USERNAME/TWINE_PASSWORD. Those credentials expired, so the0.2.0release failed both publish jobs (npm error 404 ... PUT .../@open-constructs%2faws-cdk, and403 Forbidden from https://upload.pypi.org/legacy/). Long-lived tokens have to be rotated manually and silently break about a year out.Description of changes
Switch both publish jobs to OIDC trusted publishing, configured the projen way in
.projenrc.ts(the workflow is generated, not hand-edited):npmTrustedPublishing: true— the npm job dropsNPM_TOKEN, setsNPM_TRUSTED_PUBLISHER: "true", and keeps provenance under the existingid-token: writepermission.publishToPypi.trustedPublishing: true— the PyPI job dropsTWINE_USERNAME/TWINE_PASSWORD, gainsid-token: write, and setsPYPI_TRUSTED_PUBLISHER: "true".publibexchanges the short-lived GitHub OIDC token for each registry at publish time. No stored registry secrets remain.One-time setup required before the next release (cannot be done in code):
@open-constructs/aws-cdkpointing at this repo'sreleaseworkflow.open-constructs-aws-cdk(repoopen-constructs/aws-cdk-library, workflowrelease.yml).Description of how you validated changes
Ran
npx projenand inspected the regenerated.github/workflows/release.yml: the npm job now carriesNPM_TRUSTED_PUBLISHERwith noNPM_TOKEN, and the PyPI job carriesPYPI_TRUSTED_PUBLISHERwithid-token: writeand no twine secrets.Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license