From 78b90cb86d7eb11f99a00a925c494885f5fd75fa Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 3 Nov 2026 18:59:29 +0000 Subject: [PATCH] Publish to npm through trusted publishing The publish job authenticates with the job's OpenID Connect token via the package's trusted publisher configuration on npmjs.com instead of a stored npm token, so the NPM_AUTH_TOKEN secret is no longer used. The runner's npm is updated to the current release because the OIDC flow needs npm 11.5.1 or newer. A workflow_dispatch input allows publishing an existing tag on demand. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9dd731d..761f57a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,6 +10,12 @@ on: description: Tag to publish, for example v3.1.0 required: true type: string + workflow_dispatch: + inputs: + tag: + description: Tag to publish, for example v3.1.0 + required: true + type: string jobs: lint: @@ -60,11 +66,14 @@ jobs: with: node-version: '22' registry-url: 'https://registry.npmjs.org' + # Publishing authenticates with the job's OpenID Connect token through the + # package's trusted publisher configuration on npmjs.com; no npm token is + # stored in the repository. The OIDC flow needs npm 11.5.1 or newer. + - name: Update npm + run: npm install -g npm@latest - name: Install dependencies run: npm ci - name: Build run: npm run build - name: Release run: npm publish --provenance --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}