From 90f8f57f2b7f4e410443e360e35659ace6b7a198 Mon Sep 17 00:00:00 2001 From: Jakub Freisler Date: Thu, 1 Oct 2026 17:42:50 +0200 Subject: [PATCH] ci: publish with npm trusted publishing instead of NPM_TOKEN - grant `id-token: write` to the release job so @semantic-release/npm can exchange the GitHub OIDC token for a short-lived npm token - drop the NPM_TOKEN secret from the release step Requires a trusted publisher (FRSOURCE/frs-replace, ci.yml) configured on npmjs.com before merging. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e3263cf..979c950 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: write + id-token: write # npm trusted publishing (OIDC) + provenance steps: - uses: actions/checkout@v7 with: @@ -51,7 +52,6 @@ jobs: if: ${{ success() && github.ref == 'refs/heads/main' && github.event_name == 'push' }} run: pnpm release:ci env: - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} NPM_CONFIG_REGISTRY: https://registry.npmjs.org/ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}