From 68e6413b2a3bbbf6f91b18d6162a41922a3b03af Mon Sep 17 00:00:00 2001 From: AlbertoV Date: Mon, 19 Oct 2026 14:04:56 +0200 Subject: [PATCH 1/2] ci: allow npm token while trusted publishing is configured --- .github/workflows/workflow.yaml | 10 ++++++++-- js/README.md | 12 +++++++++--- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml index 915140f..dc12fd1 100755 --- a/.github/workflows/workflow.yaml +++ b/.github/workflows/workflow.yaml @@ -54,8 +54,10 @@ jobs: registry-url: https://registry.npmjs.org # npm 11.21 supports private dist-tag reads through trusted publishing. - run: npm install --global npm@11.21.0 - - name: Check trusted publisher access + - name: Check npm publishing access run: npm dist-tag ls @dev.smartpricing/traceflow-sdk --json + env: + NODE_AUTH_TOKEN: ${{ secrets.NO_TWOFA_NPM_TOKEN }} # Kafka is needed only for its declarations; do not build its native addon. - run: npm ci --ignore-scripts @@ -64,11 +66,15 @@ jobs: - name: Verify the npm archive run: npm run test:package -- "$RUNNER_TEMP/traceflow-sdk.tgz" - - name: Publish to npm with trusted publishing + - name: Publish to npm run: npm publish "$RUNNER_TEMP/traceflow-sdk.tgz" --tag latest + env: + NODE_AUTH_TOKEN: ${{ secrets.NO_TWOFA_NPM_TOKEN }} - name: Verify published latest version # OIDC supports dist-tag, but npm view needs a separate read token for private packages. + env: + NODE_AUTH_TOKEN: ${{ secrets.NO_TWOFA_NPM_TOKEN }} run: | node --input-type=module <<'NODE' import assert from 'node:assert/strict'; diff --git a/js/README.md b/js/README.md index 0af163b..1582eb1 100644 --- a/js/README.md +++ b/js/README.md @@ -208,7 +208,13 @@ archive, then publishes that same archive. It verifies npm's `latest` tag after publishing. The existing `release/X.Y.Z` flow is also supported: commit version `X.Y.Z` before pushing. The workflow does not bump versions or merge branches. -### One-time npm setup +### npm authentication + +The workflow accepts the repository secret `NO_TWOFA_NPM_TOKEN` for npm access. +Use a valid token with read/write permission for this package and permission to +publish non-interactively. Update the secret when the token expires or is revoked. + +To remove the need to renew a publishing token, configure trusted publishing: In the package's npm settings, add a **Trusted Publisher** for GitHub Actions: @@ -221,8 +227,8 @@ In the package's npm settings, add a **Trusted Publisher** for GitHub Actions: [Trusted publishing](https://docs.npmjs.com/trusted-publishers/) authenticates through GitHub OIDC, so no npm write token or periodic token rotation is needed. The workflow uses npm 11.21+ so it can verify private package tags through OIDC. -It does not change package visibility. The old `NO_TWOFA_NPM_TOKEN` secret is no -longer used. +It does not change package visibility. npm prefers OIDC when configured and can +fall back to `NO_TWOFA_NPM_TOKEN` while trusted publishing is being set up. To verify packaging locally, run from `js/`: From d798c64befa25309ca2baf1abecac7823201f354 Mon Sep 17 00:00:00 2001 From: AlbertoV Date: Mon, 19 Oct 2026 14:06:25 +0200 Subject: [PATCH 2/2] ci: prefer the organization NPM_TOKEN secret --- .github/workflows/workflow.yaml | 6 +++--- js/README.md | 8 +++++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml index dc12fd1..e4f24f0 100755 --- a/.github/workflows/workflow.yaml +++ b/.github/workflows/workflow.yaml @@ -57,7 +57,7 @@ jobs: - name: Check npm publishing access run: npm dist-tag ls @dev.smartpricing/traceflow-sdk --json env: - NODE_AUTH_TOKEN: ${{ secrets.NO_TWOFA_NPM_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NO_TWOFA_NPM_TOKEN }} # Kafka is needed only for its declarations; do not build its native addon. - run: npm ci --ignore-scripts @@ -69,12 +69,12 @@ jobs: - name: Publish to npm run: npm publish "$RUNNER_TEMP/traceflow-sdk.tgz" --tag latest env: - NODE_AUTH_TOKEN: ${{ secrets.NO_TWOFA_NPM_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NO_TWOFA_NPM_TOKEN }} - name: Verify published latest version # OIDC supports dist-tag, but npm view needs a separate read token for private packages. env: - NODE_AUTH_TOKEN: ${{ secrets.NO_TWOFA_NPM_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NO_TWOFA_NPM_TOKEN }} run: | node --input-type=module <<'NODE' import assert from 'node:assert/strict'; diff --git a/js/README.md b/js/README.md index 1582eb1..e3030d2 100644 --- a/js/README.md +++ b/js/README.md @@ -210,8 +210,10 @@ publishing. The existing `release/X.Y.Z` flow is also supported: commit version ### npm authentication -The workflow accepts the repository secret `NO_TWOFA_NPM_TOKEN` for npm access. -Use a valid token with read/write permission for this package and permission to +The workflow uses `NPM_TOKEN` (organization or repository secret), falling back +to the legacy repository secret `NO_TWOFA_NPM_TOKEN`. Organization secrets must +allow access to this public repository; the "private repositories" policy does +not include it. Use a valid token with read/write permission for this package and permission to publish non-interactively. Update the secret when the token expires or is revoked. To remove the need to renew a publishing token, configure trusted publishing: @@ -228,7 +230,7 @@ In the package's npm settings, add a **Trusted Publisher** for GitHub Actions: through GitHub OIDC, so no npm write token or periodic token rotation is needed. The workflow uses npm 11.21+ so it can verify private package tags through OIDC. It does not change package visibility. npm prefers OIDC when configured and can -fall back to `NO_TWOFA_NPM_TOKEN` while trusted publishing is being set up. +fall back to the available npm token while trusted publishing is being set up. To verify packaging locally, run from `js/`: