Migrate npm publish to trusted publishers (OIDC)#113
Conversation
Removes the ENVOY_NPM_AUTOMATION_TOKEN secret dependency in favor of npm trusted publishing via OIDC. Adds workflow_dispatch for manual testing. Also upgrades to Node 24, drops --tag beta, and fixes deprecated ::set-output syntax. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Prevents 409 failures when manually triggering for testing purposes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5dd57f6f65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
Migrates the npm publish workflow to npm Trusted Publishers (OIDC) to remove reliance on long-lived npm automation tokens, while updating the release publishing behavior.
Changes:
- Add
id-token: writeand adjust job permissions to support OIDC-based npm publishing. - Upgrade the publish workflow to Node 24 and modernize outputs (
::set-output→$GITHUB_OUTPUT). - Publish releases without the
betadist-tag (publishing tolatest) for both npmjs and GitHub Packages.
Comments suppressed due to low confidence (1)
.github/workflows/package.yaml:23
- Minor robustness: redirecting to
$GITHUB_OUTPUTis safer when quoted (e.g.,>> "$GITHUB_OUTPUT") in case the path ever contains spaces or special characters.
echo "version=$(node --version)" >> $GITHUB_OUTPUT
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Both npm and GitHub Packages publishes are skipped when a release is marked as pre-release. Use publish-rc-manual.yaml for internal RC builds. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
ENVOY_NPM_AUTOMATION_TOKENsecret dependency in favor of npm trusted publishing via OIDC (id-token: write)Addsworkflow_dispatchtrigger for manual testing before merge--tag betaso releases publish tolatest::set-output→$GITHUB_OUTPUTGITHUB_TOKEN)Test plan
workflow_dispatch) to verify OIDC auth workslatest🤖 Generated with Claude Code