From cf8fed3ea7cf1f3e627864c6828184c5329af156 Mon Sep 17 00:00:00 2001 From: Hunter Garrett Date: Sat, 22 Aug 2026 11:34:38 -0400 Subject: [PATCH 1/2] Publish through npm trusted publishing instead of a token The trusted publisher for @camp.dev/bones is registered against campdotdev/bones and release.yml, so the npm CLI exchanges the GitHub Actions OIDC token for a short-lived credential at publish time. Nothing expires and no secret sits in the repo. Drop NPM_TOKEN and NODE_AUTH_TOKEN. Drop NPM_CONFIG_PROVENANCE too, because trusted publishing generates provenance by default. Keep id-token: write, which is what mints the OIDC token, and keep actions/setup-node, which npm docs confirm works with OIDC even when NODE_AUTH_TOKEN is unset. The runner satisfies the requirements: npm 11.17.0 against a minimum of 11.5.1, and Node 24.19.0 against a minimum of 22.14.0. Changesets 2.31.0 runs `npm publish` directly with no `npm whoami` preflight, so nothing intercepts the OIDC exchange. No changesets are pending, so merging this publishes nothing. The next release is the first to authenticate through OIDC. To roll back, restore the three env lines and set the NPM_TOKEN secret again. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a44a794..2166209 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: with: cache: true - - name: Setup npm for provenance publishing + - name: Setup npm registry uses: actions/setup-node@v4 with: registry-url: "https://registry.npmjs.org" @@ -40,9 +40,6 @@ jobs: createGithubReleases: false env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - NPM_CONFIG_PROVENANCE: true - name: Create tag and GitHub release if: steps.changesets.outputs.published == 'true' From 59b49f91f5d2a0e2aa6a2b16acb9f780f48617dc Mon Sep 17 00:00:00 2001 From: Hunter Garrett Date: Sat, 22 Aug 2026 11:41:29 -0400 Subject: [PATCH 2/2] Upgrade setup-node to v7 so OIDC auth is not blocked actions/setup-node writes `_authToken=${NODE_AUTH_TOKEN}` into the runner .npmrc. Through v6 it also exports a placeholder value when the caller sets no token: NODE_AUTH_TOKEN = process.env.NODE_AUTH_TOKEN || 'XXXXX-XXXXX-XXXXX-XXXXX' The previous commit removed NODE_AUTH_TOKEN, so the publish step would have run against an .npmrc holding that placeholder as a real credential. v7 exports the variable only when the caller provides it, which leaves the auth line unresolved and lets the npm CLI use OIDC. v4, v5, and v6 all carry the placeholder. v7 is the first release that does not. `registry-url` is still a valid input, and v7 also runs on a supported Node runtime, which clears the deprecation warning that earlier runs printed for actions/setup-node@v4. Found by CodeRabbit on #33. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2166209..5966212 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: cache: true - name: Setup npm registry - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: registry-url: "https://registry.npmjs.org"