Repository navigation
Publish releases with npm trusted publishing - #2
Merged
Merged
Conversation
Switch the release workflow from a stored NPM_TOKEN to OIDC trusted publishing: grant id-token: write, upgrade npm on the runner to a version that supports it, and drop NODE_AUTH_TOKEN. Token-based publishes to a 2FA-protected account now fail with EOTP, and granular tokens can no longer bypass 2FA. Also normalize the package.json repository field (npm pkg fix) and document the release steps in the README.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permissions: id-token: write, npm upgraded on the runner (trusted publishing needs npm 11.5.1+; Node 22 ships older),NODE_AUTH_TOKENremoved.package.jsonrepositorynormalized to an object vianpm pkg fix, which npm warned about on every publish.Why
The
v2.0.0release failed three times: first on an expiredNPM_TOKEN, then withEOTPbecause npm no longer lets granular tokens bypass 2FA on publish. Trusted publishing removes tokens and OTPs from the release path.Before merging
On npmjs.com, package
amazonads-cli> Settings > Trusted Publisher: add GitHub Actions with organization/usercprice70, repositoryamazonads-cli, workflow filenamerelease.yml, environment left blank. After merge, delete theNPM_TOKENrepository secret and any npm tokens created on 2026-10-11.Testing
npx vitest run: 31 passing.