Problem
release.yml and embedded-sdk-release.yml authenticate to npm with an NPM_TOKEN secret. A long-lived publish token is a standing credential: it does not expire, it is exfiltratable by anything that can read the workflow environment, and its compromise means arbitrary publishes under the org's package names.
npm supports trusted publishing via OIDC, which exchanges a short-lived, workflow-scoped identity for publish rights and removes the stored secret entirely. Several recent npm compromises turned on exactly this kind of stolen token.
Proposed change
Migrate both workflows to OIDC trusted publishing and delete the NPM_TOKEN secret once the first release under it succeeds. Worth doing one workflow first and confirming a real publish before moving the second.
Verified against master at 3539c41dab.
Imported from the parent repository for autonomous engineering evaluation.
Source issue: apache#42992
Problem
release.ymlandembedded-sdk-release.ymlauthenticate to npm with anNPM_TOKENsecret. A long-lived publish token is a standing credential: it does not expire, it is exfiltratable by anything that can read the workflow environment, and its compromise means arbitrary publishes under the org's package names.npm supports trusted publishing via OIDC, which exchanges a short-lived, workflow-scoped identity for publish rights and removes the stored secret entirely. Several recent npm compromises turned on exactly this kind of stolen token.
Proposed change
Migrate both workflows to OIDC trusted publishing and delete the
NPM_TOKENsecret once the first release under it succeeds. Worth doing one workflow first and confirming a real publish before moving the second.Verified against
masterat3539c41dab.Imported from the parent repository for autonomous engineering evaluation.
Source issue: apache#42992