From 00836abb46ad54547750711a10f937bd1a89589f Mon Sep 17 00:00:00 2001 From: Riccardo Cipolleschi Date: Wed, 8 Jul 2026 15:27:25 +0200 Subject: [PATCH] fix(release): enable npm trusted publishing (OIDC) to match stable branches Ports the working release setup from 0.87-stable so branches cut from main start correct: - add permissions: id-token: write (OIDC) + contents: write (push commit/tag) - bump actions/setup-node@v4.0.0 -> @v6 (older versions write a placeholder NODE_AUTH_TOKEN that defeats OIDC, causing E404/ENEEDAUTH) - package-manager-cache: false (avoid leaking the short-lived OIDC token) package.json already has the repository field (needed for provenance) via #241. --- .github/workflows/release.yaml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 4e7d6f3..151d26e 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -21,6 +21,11 @@ jobs: publish_template: runs-on: ubuntu-latest environment: npm-publish + permissions: + # Required for npm trusted publishing (OIDC token exchange with the registry) + id-token: write + # Required so the bump commit & tag can be pushed back to the branch + contents: write steps: - name: Safeguard against branch name run: | @@ -31,10 +36,18 @@ jobs: - name: Checkout uses: actions/checkout@v4.1.1 - name: Setup node.js - uses: actions/setup-node@v4.0.0 + # setup-node@v6 supports npm trusted publishing (OIDC): with `registry-url` + # set and no token provided, it configures the registry without writing a + # bogus NODE_AUTH_TOKEN placeholder, so `npm publish` performs the OIDC + # token exchange. Older versions (e.g. v4) wrote a placeholder token that + # made npm attempt token auth instead, failing with E404/ENEEDAUTH. + uses: actions/setup-node@v6 with: node-version: 'lts/*' registry-url: 'https://registry.npmjs.org' + # Never cache dependencies in a publishing workflow: a poisoned cache + # could expose the short-lived OIDC token. + package-manager-cache: false - name: Determine new template version run: echo "VERSION=$(./scripts/bumpedTemplateVersion.sh ${{ inputs.version }})" >> $GITHUB_ENV - name: Update versions to input one