Publish to npm with OIDC trusted publishing - #957
Closed
graygilmore wants to merge 2 commits into
Closed
graygilmore wants to merge 2 commits into
graygilmore wants to merge 2 commits into
Conversation
The snapit workflow authenticated to npm with the long-lived NPM_TOKEN secret. Shopify/snapit v0.1.0 dropped token support and publishes over OIDC instead, so this bumps the action, points setup-node at the npm registry so the CLI can complete the OIDC exchange, and drops the token from the step. The comment_packages input replaces the renamed github_comment_included_packages. Assisted-By: devx/d9810122-2b8f-4f8d-b51b-eb980219e4b6
The release workflow already requested id-token: write for provenance but still authenticated the publish with NPM_TOKEN. Set NPM_TOKEN to an empty string so changesets/action skips writing a token to .npmrc and lets npm fall through to OIDC, and add registry-url so setup-node configures the registry the CLI exchanges the token with. changesets/action moves to v1.9.0 because token-less publishing only became a supported path in v1.7.0. Assisted-By: devx/d9810122-2b8f-4f8d-b51b-eb980219e4b6
kdaviduik
reviewed
Sep 14, 2026
Contributor
|
#952 merged |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both publishing workflows in this repo still authenticate to npm with the
NPM_TOKENsecret. npm's recommended path for CI publishing is now trusted publishing (OIDC), which is what hydrogen and theme-tools already use, so this PR moves both workflows over:npm-release.yml: setsNPM_TOKEN: ''sochangesets/actionskips writing a token to.npmrcand npm falls through to OIDC.changesets/actionmoves to v1.9.0 because that path only exists from v1.7.0.setup-nodegetsregistry-urlso the CLI knows which registry to exchange the OIDC token with.snapit.yml: bumpsShopify/snapitto v0.1.0, which droppedNPM_TOKENsupport and publishes over OIDC. Thegithub_comment_included_packagesinput was renamed tocomment_packagesin that release.Before merging
Trusted publishing is configured per package and per workflow file on npmjs.com, so
@shopify/buy-button-jsneeds bothnpm-release.ymlandsnapit.ymlregistered for this repo before this lands. Otherwise the next publish fails withENEEDAUTH. That happens on the npm side, not in this diff.Once the first OIDC publish goes through, the
NPM_TOKENrepo secret can be deleted.Reviewer notes
This overlaps with #952, which makes the same
npm-release.ymlchange as part of a larger modernization stack. This PR is intentionally standalone againstmainso it can land on its own. Happy to drop it if that stack is close to landing.issue_commentworkflows always run frommain, so thesnapit.ymlchange can't be tried on this PR. TheForce snapshotstep also still writes tosnapshot.txtinstead of.changeset/, which I don't think does anything; left alone since it's unrelated.