From 8f551e66bcdabd2c9143c18a09c83c0412a8581b Mon Sep 17 00:00:00 2001
From: rp-maintainers <rp_maintainers@routeplane.ai>
Date: Thu, 13 Aug 2026 17:39:40 +0000
Subject: [PATCH] ci: add read-only npm publisher audit

---
 .github/workflows/npm-trust-audit.yml | 29 +++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 .github/workflows/npm-trust-audit.yml

diff --git a/.github/workflows/npm-trust-audit.yml b/.github/workflows/npm-trust-audit.yml
new file mode 100644
index 0000000..04adb2c
--- /dev/null
+++ b/.github/workflows/npm-trust-audit.yml
@@ -0,0 +1,29 @@
+name: Audit npm trusted publishers
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: npm
+    steps:
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.19.0
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+      - name: Read trusted publisher claims
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          test "$(npm --version)" = "11.17.0"
+          for package in @routeplane/sdk @routeplane/cli @routeplane/mcp-server; do
+            echo "${package}"
+            npm trust list "${package}" --registry=https://registry.npmjs.org/ --json \
+              | jq 'map({type, claims, permissions})'
+          done