Skip to content

ci: publish to npm with trusted publishing (OIDC) - #2778

Merged
Snailedlt merged 2 commits into
devicons:masterfrom
Snailedlt:fix/npm-trusted-publishing
Oct 25, 2026
Merged

Snailedlt merged 2 commits into
devicons:masterfrom
Snailedlt:fix/npm-trusted-publishing

Conversation

@Snailedlt

@Snailedlt Snailedlt commented Oct 25, 2026 •

Copy link
Copy Markdown
Collaborator

Switches npm publishing to trusted publishing (OIDC), so no long-lived npm token is needed.

  • Publish with OIDC (id-token: write) instead of a token; provenance is attached automatically
  • Least-privilege permissions, scoped to the job
  • Skip npm ci (nothing to build), so dependency install scripts never run in the publish job
  • Check out the release tag rather than the target branch, so the published code matches the release
  • Disable caching and credential persistence
  • Add workflow_dispatch to allow re-running a publish manually

🤖 Generated with Claude Code

Yashh56
Yashh56 previously approved these changes Oct 25, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Comment thread .github/workflows/npm_publish.yml
Co-authored-by: Yashh56 <141008488+Yashh56@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@Snailedlt
Snailedlt force-pushed the fix/npm-trusted-publishing branch from 97ade43 to b2c430a Compare October 25, 2026 15:48
@Snailedlt
Snailedlt requested a review from Yashh56 October 25, 2026 15:48

@Yashh56 Yashh56 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@Snailedlt
Snailedlt merged commit 4fbcc68 into devicons:master Oct 25, 2026
6 checks passed
@Snailedlt
Snailedlt deleted the fix/npm-trusted-publishing branch October 25, 2026 15:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants