Migrate npm publish to trusted publishers (OIDC)#113
Migrate npm publish to trusted publishers (OIDC)#113JustWalters wants to merge 5 commits intomasterfrom
Conversation
Removes the ENVOY_NPM_AUTOMATION_TOKEN secret dependency in favor of npm trusted publishing via OIDC. Adds workflow_dispatch for manual testing. Also upgrades to Node 24, drops --tag beta, and fixes deprecated ::set-output syntax. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Prevents 409 failures when manually triggering for testing purposes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5dd57f6f65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - run: npm publish --tag beta --access public | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.ENVOY_NPM_AUTOMATION_TOKEN }} | ||
| - run: npm publish --access public |
There was a problem hiding this comment.
This publish command uses OIDC but omits --provenance, so npm will publish without generating a provenance attestation even though this migration is explicitly targeting trusted publishing. I verified CLI semantics via npm publish --help (where --provenance is optional) and npm config get provenance (default false), so in this workflow the release can succeed but still miss the supply-chain metadata expected from trusted publishers.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
https://docs.npmjs.com/trusted-publishers#automatic-provenance-generation
When you publish using trusted publishing, npm automatically generates and publishes provenance attestations for your package. This happens by default—you don't need to add the --provenance flag to your publish command.
https://www.npmjs.com/package/@envoy/envoy-integrations-sdk/v/2.5.1#provenance
There was a problem hiding this comment.
Pull request overview
Migrates the npm publish workflow to npm Trusted Publishers (OIDC) to remove reliance on long-lived npm automation tokens, while updating the release publishing behavior.
Changes:
- Add
id-token: writeand adjust job permissions to support OIDC-based npm publishing. - Upgrade the publish workflow to Node 24 and modernize outputs (
::set-output→$GITHUB_OUTPUT). - Publish releases without the
betadist-tag (publishing tolatest) for both npmjs and GitHub Packages.
Comments suppressed due to low confidence (1)
.github/workflows/package.yaml:23
- Minor robustness: redirecting to
$GITHUB_OUTPUTis safer when quoted (e.g.,>> "$GITHUB_OUTPUT") in case the path ever contains spaces or special characters.
echo "version=$(node --version)" >> $GITHUB_OUTPUT
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - run: npm publish --tag beta --access public | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.ENVOY_NPM_AUTOMATION_TOKEN }} | ||
| - run: npm publish --access public |
There was a problem hiding this comment.
The PR description calls out verifying provenance attestation, but the publish command doesn’t explicitly enable provenance generation. To avoid relying on npm’s default behavior (which can change across npm versions), consider making it explicit via npm publish --provenance ... or setting NPM_CONFIG_PROVENANCE=true for the publish step.
There was a problem hiding this comment.
I'm fine with relying on default behavior here.
Both npm and GitHub Packages publishes are skipped when a release is marked as pre-release. Use publish-rc-manual.yaml for internal RC builds. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
ENVOY_NPM_AUTOMATION_TOKENsecret dependency in favor of npm trusted publishing via OIDC (id-token: write)Addsworkflow_dispatchtrigger for manual testing before merge--tag betaso releases publish tolatest::set-output→$GITHUB_OUTPUTGITHUB_TOKEN)Test plan
workflow_dispatch) to verify OIDC auth workslatest🤖 Generated with Claude Code