Skip to content

Commit b7c147f

Browse files
Swimburgerdevalog
andauthored
Apply suggestions from code review
Co-authored-by: Devin Logan <[email protected]>
1 parent 7369f7f commit b7c147f

File tree

1 file changed

+7
-8
lines changed

1 file changed

+7
-8
lines changed

fern/products/sdks/overview/typescript/publishing-to-npm.mdx

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -106,19 +106,18 @@ groups:
106106
107107
## Configure authentication
108108
109-
Choose how you want to authenticate with npmjs when publishing. **OpenID Connect (OIDC) is strongly recommended** for security.
109+
Choose how you want to authenticate with npmjs when publishing.
110110
111-
<Note>
112-
**Starting in early 2025**, npmjs.org is deprecating long-lived authentication tokens for publishing from CI/CD workflows. OIDC-based authentication is recommended.
113-
</Note>
111+
<Warning>
112+
**Starting in early 2025**, npmjs.org is deprecating long-lived authentication tokens for publishing from CI/CD workflows. **OpenID Connect (OIDC) authentication is strongly recommended** for security.
113+
</Warning>
114114
115115
<AccordionGroup>
116116
<Accordion title="OIDC authentication (Recommended)">
117117
118118
OIDC-based publishing (also known as "trusted publishing") is the most secure way to publish. With OIDC, you don't need to manage authentication tokens - npmjs trusts your GitHub repository to publish directly.
119119
120-
<Info>
121-
**Requirements:**
120+
<Info title="Prerequisites">
122121
- Fern TypeScript SDK generator version `3.12.0` or later
123122
- Fern CLI version `0.94.0` or later (only required for local generation with `--local`)
124123
</Info>
@@ -156,7 +155,7 @@ OIDC-based publishing (also known as "trusted publishing") is the most secure wa
156155
fern generate --group ts-sdk
157156
```
158157

159-
Or push your `generators.yml` changes and let the Fern GitHub Action generate it for you.
158+
This creates a `.github/workflows/ci.yml` file that's configured to use OIDC for npmjs publishing. Alternatively, you can push your `generators.yml` changes and let the Fern GitHub Action generate the workflow for you.
160159

161160
This creates a `.github/workflows/ci.yml` file that's configured to use OIDC for npm publishing.
162161

@@ -202,7 +201,7 @@ Provenance attestations aren't generated for packages published from private rep
202201
<Accordion title="Token-based authentication (Legacy)">
203202

204203
<Warning>
205-
**This method is being deprecated by npmjs.org in early 2025.** OIDC-based authentication is strongly recommended instead. Long-lived authentication tokens can be exposed in logs, compromised, and are difficult to manage and rotate.
204+
**This method is being deprecated by npmjs.org in early 2025.** Long-lived authentication tokens can be exposed in logs, compromised, and are difficult to manage and rotate. [OIDC-based authentication is strongly recommended instead](#migrating-from-token-based-to-oidc-publishing).
206205
</Warning>
207206

208207
<Steps>

0 commit comments

Comments
 (0)