From 5e0c1247d128c4e3a7d2d104f5d28081aaf20b3c Mon Sep 17 00:00:00 2001 From: Grischa Erbe Date: Wed, 29 Apr 2026 23:52:43 +0200 Subject: [PATCH 1/2] Switch npm publish to OIDC trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the long-lived NODE_AUTH_TOKEN with GitHub's OIDC flow now that the repo is registered as a trusted publisher on npm. The previous v3.0.0 release attempt failed with E404 because the secret token had expired. - Add `permissions: id-token: write` so GitHub mints an OIDC token for the publish step. - Bump publish job to Node 24 (npm 11.5+) — trusted publishing requires npm >= 11.5.1, and Node 22 still ships with npm 10.x. - Drop `NODE_AUTH_TOKEN`; npm picks up the OIDC token automatically and produces provenance attestations by default. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/npm-publish.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 339dc79..2e8e464 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -21,14 +21,15 @@ jobs: publish-npm: needs: build runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 24 registry-url: https://registry.npmjs.org/ - run: npm ci - run: npm run build - run: npm publish - env: - NODE_AUTH_TOKEN: ${{secrets.npm_token}} From 6d9d69d9a5bd618a7bba349cfafab3370feebef1 Mon Sep 17 00:00:00 2001 From: Grischa Erbe Date: Wed, 29 Apr 2026 23:53:20 +0200 Subject: [PATCH 2/2] Align release-workflow build job to Node 24 Matches the publish-npm bump in the previous commit so both jobs in the release workflow run on the same Node version. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/npm-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 2e8e464..06ac8b4 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 24 - run: npm ci - run: npm test