DX-2278: update release to use npm OIDC

[CahidArda]

NPM OIDC Migration Instructions

Migrate npm publishing from NPM_TOKEN to npm OIDC with provenance attestation.

Prerequisites

Configure npm trusted publishers on npmjs.com:

• Go to package settings → "Publishing access" → Add trusted publisher
• Repository: upstash/<package-name>
• Workflow: ci.yml (the router workflow)

Changes

1. package.json

Add repository field (required for npm provenance):

"repository": {
  "type": "git",
  "url": "git@github.com:upstash/<package-name>.git"
}

2. Create .github/workflows/ci.yml

Create a router workflow that calls tests and release workflows. npm OIDC only allows one workflow file to have publish permission, so both workflows must be called from this single router.

• Triggers: pull_request, release.published, schedule
• Permissions: id-token: write, contents: read
• Jobs:
  • tests: runs on non-release events, calls tests.yaml with secrets: inherit
  • release: runs on release events, calls release.yml with prerelease: ${{ github.event.release.prerelease }} input and secrets: inherit

3. Update .github/workflows/release.yml

• Change trigger from release.published to workflow_call with prerelease boolean input
• Update actions/checkout to v4
• Update actions/setup-node to v4 with node-version: 24 and add registry-url: https://registry.npmjs.org
• Remove the "Add npm token" step that creates .npmrc
• Add --provenance flag to all npm publish commands
• Change prerelease condition from github.event.release.prerelease to inputs.prerelease

4. Update .github/workflows/tests.yaml

• Change trigger from pull_request/schedule to workflow_call
• In the CI canary release job:
  • Update actions/checkout to v4
  • Update actions/setup-node to v4 with node-version: 24 and add registry-url: https://registry.npmjs.org
  • Remove the "Add npm token" step that creates .npmrc
  • Add --provenance flag to npm publish command

5. Changes in Repo Settings on Github

• Removed NPM_TOKEN secret
• Checked that "Approval for running fork pull request workflows from contributors" setting in action settings is set to "Require approval for all external contributors"

Summary

Before	After
NPM_TOKEN in .npmrc	registry-url in setup-node
npm publish	npm publish --provenance
actions/checkout@v3	actions/checkout@v4
actions/setup-node@v2/v3	actions/setup-node@v4
Node 18/20	Node 24
Direct workflow triggers	workflow_call + router ci.yml

[linear]

DX-2278 SDK CIs - check npm OIDC

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ratelimit-with-vercel-kv	Ready	Preview, Comment	Feb 5, 2026 8:11am

[Copilot]

Pull request overview

This PR migrates the npm release workflow from traditional token-based authentication to OIDC (OpenID Connect) authentication, following npm's trusted publishers documentation. The change enhances security by eliminating the need to store long-lived npm tokens as secrets.

Changes:

• Add OIDC permissions (id-token: write and contents: read) to enable GitHub Actions OIDC authentication
• Update GitHub Actions to newer versions (checkout@v4, setup-node@v4) and configure npm registry URL
• Remove manual npm token authentication step in favor of OIDC
• Update Node.js version from 18 to 24

Comments suppressed due to low confidence (1)

.github/workflows/release.yml:49

• The publish steps are missing the NODE_AUTH_TOKEN environment variable required for OIDC authentication. When using registry-url with actions/setup-node for OIDC authentication, npm publish commands need to have NODE_AUTH_TOKEN set. Add the environment variable to both publish steps:

env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

This environment variable tells npm to use the OIDC token generated by GitHub Actions for authentication with the npm registry.

      - name: Publish release candidate
        if: "github.event.release.prerelease"
        run: npm publish --access public --tag=canary --no-git-checks

      - name: Publish
        if: "!github.event.release.prerelease"
        run: npm publish --access public --no-git-checks

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.