feat: migrate npm publish to OIDC authentication#2381
Conversation
Replace NPM_TOKEN secret with GitHub Actions OIDC for npm publishing. This removes the need to manage npm access tokens as repository secrets and adds provenance attestation to published packages. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
Migrates the npm publishing flow in the release pipeline from a long-lived NPM_TOKEN secret to GitHub Actions OIDC-based trusted publishing, and enables npm provenance attestations.
Changes:
- Add GitHub Actions OIDC permissions (
id-token: write) to the release workflow. - Remove
NODE_AUTH_TOKENusage from npm publish steps in the release workflow. - Add
--provenanceto the monorepo publish scripts used during releases.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
package.json |
Appends --provenance to release/prerelease publish scripts to generate supply-chain attestations. |
.github/workflows/release.yml |
Enables OIDC via permissions and removes npm token env usage during publishing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Publish release to npm | ||
| if: ${{ github.event.pull_request.head.ref == 'prepare-release' }} | ||
| run: | | ||
| pnpm release | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | ||
|
|
||
| - name: Publish prerelease to npm | ||
| if: ${{ github.event.pull_request.head.ref == 'prepare-prerelease' }} | ||
| run: | | ||
| pnpm release:prerelease |
There was a problem hiding this comment.
With workflow_dispatch enabled, this job can run without a PR context, but both publish steps are gated on github.event.pull_request.head.ref. For manual dispatch runs, these conditions evaluate false and nothing gets published to npm (while later steps still finalize the GitHub release). Consider either removing workflow_dispatch or adding dispatch inputs (e.g. release vs prerelease) and updating the if: conditions to publish when github.event_name == 'workflow_dispatch' (or based on github.ref_name).
| permissions: | ||
| id-token: write | ||
| contents: write | ||
|
|
There was a problem hiding this comment.
Repo workflows consistently scope permissions at the job level (e.g. docs-sync.yml, release-dispatch.yml, claude.yml), but this workflow sets them at the top level. Keeping id-token: write scoped to just the publishing job reduces blast radius if more jobs are added later; consider moving this permissions block under jobs.publish.permissions (and defaulting workflow permissions to read).
Code ReviewI found a critical issue that will prevent this PR from working as intended: ❌ Publishing will fail - npm version does not support OIDC trusted publishingLocation: The workflow uses The Problem:
Result: Both ✅ How to FixOption 1 (Recommended): Upgrade to Node.js 22.x Change line 29 in - uses: actions/setup-node@v4
with:
node-version: "22.x" # Changed from 20.x
registry-url: "https://registry.npmjs.org/"Node.js 22.x ships with npm 11.0+ which supports OIDC trusted publishing. Option 2: Manually upgrade npm Add a step after - uses: actions/setup-node@v4
with:
node-version: "20.x"
registry-url: "https://registry.npmjs.org/"
- name: Upgrade npm
run: npm install -g npm@latest📚 References
Note: Make sure to configure trusted publishers on npmjs.com as mentioned in the PR description before merging. |
npm OIDC trusted publishing requires npm 11.5.0+, which ships with Node.js 22.x. Node.js 20.x only includes npm 10.x which does not support OIDC authentication. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Claude finished @steebchen's task —— View job Analyzing controller PR changes and updating documentation
|
Summary
NPM_TOKENsecret with GitHub Actions OIDC for npm publishing in the release workflowpermissions: id-token: writeto enable OIDC token generationNODE_AUTH_TOKENenv vars from publish steps--provenanceflag to publish commands for supply chain attestationPrerequisites
Before merging, configure trusted publishers on npmjs.com for both packages:
cartridge-gg/controllerand workflow torelease.ymlAfter this is configured, the
NPM_TOKENsecret can be removed from the repository settings.Test plan
@cartridge/controllerand@cartridge/connectorNPM_TOKENsecret from repository settings after successful publish🤖 Generated with Claude Code