Skip to content

Commit 617e979

Browse files
committed
Apply feedback
1 parent f31f314 commit 617e979

File tree

1 file changed

+1
-7
lines changed

1 file changed

+1
-7
lines changed

content/packages-and-modules/securing-your-code/trusted-publishers.mdx

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -158,12 +158,6 @@ Once you've configured trusted publishers for your package, we strongly recommen
158158
2. Select **"Require two-factor authentication and disallow tokens"**
159159
3. Save your changes by clicking on **Update Package Settings**
160160

161-
This configuration:
162-
- **Allows** publishing through trusted publishers (OIDC)
163-
- **Blocks** all personal access tokens and automation tokens
164-
- **Reduces** the risk of unauthorized publishing
165-
- **Maintains** your automated CI/CD workflows through GitHub Actions or GitLab CI/CD.
166-
167161
### Why this matters
168162

169163
Trusted publishers use short-lived, scoped credentials that are generated on-demand during your CI/CD workflow, eliminating the need for long-lived tokens. By restricting traditional token access while using trusted publishers, you reduce potential security risks associated with credential management.
@@ -175,7 +169,7 @@ Trusted publishers use short-lived, scoped credentials that are generated on-dem
175169
If you're transitioning from token-based publishing:
176170
1. Set up trusted publishers first and verify they work
177171
2. Then restrict token access as described above
178-
3. Revoke any existing automation tokens that are no longer needed
172+
3. [Revoke any existing automation tokens](https://docs.npmjs.com/revoking-access-tokens) that are no longer needed
179173

180174
This ensures a smooth transition without disrupting your release process.
181175

0 commit comments

Comments
 (0)