Harden npm trusted publishing workflow

[kody-bot]

Summary

• keep npm OIDC/id-token permission out of install/build/test jobs where possible
• run package build/test work before entering the publish-authorized job
• disable package-manager caching in publish jobs
• install publish-time tooling with lifecycle scripts disabled when the custom release command requires local tooling
• pin release-path actions to commit SHAs

Context

Triggered by the TanStack npm supply-chain compromise postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

Testing

• workflow syntax checked by construction against the existing workflow shape

[nx-cloud]

View your CI Pipeline Execution ↗ for commit fc6a90a

Command	Status	Duration	Result
nx run-many --target typecheck	✅ Succeeded	2s	View ↗
nx run-many --target build	✅ Succeeded	1s	View ↗
nx lint	✅ Succeeded	1s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-05-13 00:07:58 UTC