From 809c2450be55df045f5df131880e0f6370a8bfed Mon Sep 17 00:00:00 2001 From: apinator-dev Date: Sat, 17 Oct 2026 16:17:32 +0200 Subject: [PATCH] ci: publish to npm via trusted publishing (OIDC) Replace the NPM_TOKEN secret with GitHub OIDC trusted publishing. --- .github/workflows/release.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5271d57..0a1b32c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,12 +24,19 @@ jobs: needs: release-please if: ${{ needs.release-please.outputs.release_created }} runs-on: ubuntu-latest + # Trusted publishing: npm exchanges this job's GitHub OIDC token for a + # short-lived publish credential, so no npm token secret is stored. + # Configured per package on npmjs.com (Settings -> Trusted Publisher). + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: 20 + # Trusted publishing needs npm >= 11.5.1, which ships with Node 24. + node-version: 24 registry-url: https://registry.npmjs.org cache: npm @@ -49,5 +56,3 @@ jobs: - name: Publish to npm run: npm publish --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}