ci: publish with a 2FA-bypass token and attach provenance #1

	name: Release

	on:
	push:
	tags: ["v*"]
	workflow_dispatch:

	permissions:
	contents: write
	id-token: write

	jobs:
	publish:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 24
	registry-url: https://registry.npmjs.org
	# Never restore a cache in a release build: the published artefact
	# should come from exactly what is in the tag.
	cache: ""

	- run: npm ci
	- run: npm run check
	- run: npm run build

	# Publishing uses a granular token with the 2FA bypass enabled, since the
	# account's second factor is a passkey and cannot produce an OTP for CI.
	#
	# npm has announced that 2FA-bypass tokens lose direct publishing around
	# January 2027 (https://gh.io/npm-gat-bypass2fa-deprecation). Before then
	# this should move to trusted publishing (OIDC), which needs no secret at
	# all: configure it at npmjs.com/package/opencode-github-sync/access, then
	# delete both the NPM_TOKEN secret and the env block below.
	- name: Publish to npm
	run: npm publish --access public --provenance
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

	- name: Create the GitHub release
	uses: softprops/action-gh-release@v2
	with:
	generate_release_notes: true

Navigation Menu