Skip to content

ci(release): publish to npm via trusted publishing (OIDC) #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amondnet merged 2 commits into from
Jul 1, 2026
Merged

ci(release): publish to npm via trusted publishing (OIDC) #105

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0a9cf4c
ci(release): publish to npm via trusted publishing (OIDC)
amondnet Jul 1, 2026
6de7e53
ci(release): make npm publish idempotent (skip already-published vers…
amondnet Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 24 additions & 4 deletions .github/workflows/release-please.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,29 @@ jobs:
- name: Build npm packages
run: bun run build:npm

# Trusted publishing (OIDC) needs npm >= 11.5.1; setup-node's bundled npm may be older.
- name: Upgrade npm for trusted publishing
run: npm install -g npm@latest

# No NODE_AUTH_TOKEN: npm detects the GitHub Actions OIDC environment (id-token: write)
# and authenticates via the per-package Trusted Publisher configured on npmjs.com.
# Provenance is generated automatically for trusted publishing.
# Idempotent: skip versions already on npm so a re-run (e.g. after a
# partial publish) only pushes the packages still missing, instead of
# aborting on the first "cannot publish over previous version".
- name: Publish to npm
run: |
for dir in npm/code-*; do
(cd "$dir" && npm publish --provenance --access public)
done
cd npm/code && npm publish --provenance --access public
set -euo pipefail
publish_if_new() {
local dir="$1" name ver
name=$(cd "$dir" && node -p "require('./package.json').name")
ver=$(cd "$dir" && node -p "require('./package.json').version")
if npm view "$name@$ver" version >/dev/null 2>&1; then
echo "== skip $name@$ver (already published)"
else
echo "== publish $name@$ver"
(cd "$dir" && npm publish --access public)
fi
}
for dir in npm/code-*; do publish_if_new "$dir"; done
publish_if_new npm/code
Loading