From 7ebd8bdb542455fcd2bab1c618f27f3dc7df0242 Mon Sep 17 00:00:00 2001 From: Mike Little Date: Tue, 18 Aug 2026 15:49:44 +0100 Subject: [PATCH 1/2] Publish to npm via trusted publishing instead of NPM_TOKEN npm is now configured as a trusted publisher for this repo, so the OIDC exchange replaces the stored token. Upgrades npm to a version that supports trusted publishing. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 9 ++++++--- RELEASING.md | 15 ++++++--------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d92b974..9744f79 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,7 +1,8 @@ name: Release # Publishes to npm when a GitHub Release is published. -# See RELEASING.md for the full process and required NPM_TOKEN secret. +# Authenticates to npm as a trusted publisher via OIDC (no token needed). +# See RELEASING.md for the full process. on: release: types: [published] @@ -21,6 +22,10 @@ jobs: node-version: 20 registry-url: 'https://registry.npmjs.org' + # Trusted publishing via OIDC requires npm >= 11.5.1; Node 20 ships npm 10. + - name: Upgrade npm + run: npm install -g npm@latest + - run: npm ci - name: Verify tag matches package.json version @@ -42,5 +47,3 @@ jobs: - name: Publish to npm run: npm publish --provenance --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/RELEASING.md b/RELEASING.md index 64e51d5..a6e0c80 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -47,17 +47,14 @@ Publishing the release triggers `.github/workflows/release.yml`, which: - runs `npm audit` (advisory — does not block the release), - publishes to npm with [provenance](https://docs.npmjs.com/generating-provenance-statements). -## One-time setup: the `NPM_TOKEN` secret +## One-time setup: trusted publishing -Publishing needs an npm access token stored as a repository secret named -`NPM_TOKEN`: +Publishing authenticates to npm as a +[trusted publisher](https://docs.npmjs.com/trusted-publishers) via OIDC — no +token or repository secret is required. -1. On [npmjs.com](https://www.npmjs.com/) → **Access Tokens** → **Generate New - Token** → **Granular Access Token** (recommended) with **Read and write** - permission scoped to the `altis-cli` package. Use an **Automation** token so - it bypasses 2FA in CI. -2. In GitHub: **Settings → Secrets and variables → Actions → New repository - secret**, name it `NPM_TOKEN`, and paste the token. +The workflow grants `id-token: write` (for the OIDC exchange) and upgrades npm +to a version new enough to support trusted publishing. Provenance additionally requires the repository to be public and the `repository` field in `package.json` to be set (both already true). From 515920c77c553100c1ddfa849b2888e430a2ee25 Mon Sep 17 00:00:00 2001 From: Mike Little Date: Tue, 8 Sep 2026 11:29:51 +0100 Subject: [PATCH 2/2] Address PR review: Node 24, drop registry-url, document trusted-publishing setup registry-url made setup-node@v4 write a dummy auth line that stops the OIDC exchange, and npm@latest now needs Node >= 22.22. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01GW2L1D5GVdMkn4WtRpbtZP --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 5 ++--- RELEASING.md | 14 +++++++++++++- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ce76636..c69656e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: - uses: actions/setup-node@v4 with: - node-version: 20 + node-version: 24 - run: npm ci diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9744f79..c6f15aa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,10 +19,9 @@ jobs: - uses: actions/setup-node@v4 with: - node-version: 20 - registry-url: 'https://registry.npmjs.org' + node-version: 24 - # Trusted publishing via OIDC requires npm >= 11.5.1; Node 20 ships npm 10. + # Trusted publishing via OIDC requires npm >= 11.5.1; pin to latest to be safe. - name: Upgrade npm run: npm install -g npm@latest diff --git a/RELEASING.md b/RELEASING.md index a6e0c80..08d1345 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -53,8 +53,20 @@ Publishing authenticates to npm as a [trusted publisher](https://docs.npmjs.com/trusted-publishers) via OIDC — no token or repository secret is required. +A package admin configures this once on npmjs.com. If the config is ever lost, +or you set this up for another package, these are the fields — npm matches them +exactly and they are **case-sensitive**: + +1. Go to the [`altis-cli` package](https://www.npmjs.com/package/altis-cli) → + **Settings** → **Trusted publisher** → **GitHub Actions**. +2. Organization or user: `humanmade` +3. Repository: `altis-cli` +4. Workflow filename: `release.yml` (exactly, including the `.yml`) +5. Environment: **leave blank** — this repo has no GitHub environments + configured, so anything entered here will cause the publish to fail. + The workflow grants `id-token: write` (for the OIDC exchange) and upgrades npm -to a version new enough to support trusted publishing. +to a version new enough to support trusted publishing (npm 11.5.1+). Provenance additionally requires the repository to be public and the `repository` field in `package.json` to be set (both already true).