From 78a57ffc792d184a71503f7a3bc2d7657525f106 Mon Sep 17 00:00:00 2001 From: thestreamcode Date: Wed, 14 Oct 2026 21:23:38 +0200 Subject: [PATCH] ci: use npm Trusted Publishing instead of NPM_TOKEN --- .github/workflows/publish.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 1004805..7e8ea3d 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -40,8 +40,7 @@ jobs: run: npm pack --dry-run - name: Publish with provenance + # Trusted Publishing (OIDC): no token here on purpose. npm authenticates + # the run from the id-token permission above; setting NODE_AUTH_TOKEN + # would switch npm back to token auth and break the publish. run: npm publish --access public --provenance - env: - # Needed only to bootstrap the first publication. Remove the secret - # after configuring npm Trusted Publishing for this workflow. - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}