From e96f0628f68b0895c07d915decf97f927ca24919 Mon Sep 17 00:00:00 2001 From: "V. David Zvenyach" Date: Mon, 19 Oct 2026 16:08:30 -0500 Subject: [PATCH] ci(publish): publish to npm with trusted publishing The publish job now authenticates to npm with the workflow's own OIDC identity instead of a stored npm token, which had expired and failed the v1.4.0 publish. Trusted publishing needs npm 11.5.1 or later, so the job upgrades npm before publishing. Provenance is unchanged. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/publish.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index fd86fe7..b8b9959 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -34,8 +34,10 @@ jobs: - name: Build run: npm run build + # Trusted publishing authenticates with this job's OIDC token instead of a stored npm token, and needs npm 11.5.1 or later. + - name: Upgrade npm + run: npm install -g npm@11 + - name: Publish - env: - NODE_AUTH_TOKEN: ${{ secrets.TANGO_NPM_TOKEN }} run: npm publish --access public --provenance