From d113742ec3dbecf79e4d4e813d2c5a746320d928 Mon Sep 17 00:00:00 2001 From: jack755051 Date: Sun, 27 Sep 2026 19:02:06 +0800 Subject: [PATCH] ci: publish npm via OIDC trusted publishing Token publish keeps asking for OTP. GitHub Actions can publish @sanring/cli with id-token instead of NPM_TOKEN. Co-authored-by: Cursor --- .github/workflows/release.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index be887d5f..516b75cf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,7 @@ jobs: permissions: contents: write pull-requests: write + id-token: write steps: - name: Checkout uses: actions/checkout@v4 @@ -31,11 +32,15 @@ jobs: with: node-version: 24 cache: pnpm - registry-url: https://registry.npmjs.org - name: Install dependencies run: pnpm install --frozen-lockfile + # changesets/action writes ~/.npmrc from NPM_TOKEN if that file is missing. + # A token-backed npmrc forces OTP (EOTP). Trusted publishing uses OIDC instead. + - name: Use OIDC for npm publish + run: printf 'registry=https://registry.npmjs.org/\n' > "$HOME/.npmrc" + - name: Create Release Pull Request or Publish uses: changesets/action@v1 with: @@ -44,5 +49,3 @@ jobs: commit: "chore: version packages" env: GITHUB_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}