feat(ci): migrate to npm OIDC trusted publishing #390

TabishB · 2025-12-22T08:01:03Z

Summary

Migrate from classic npm tokens (now revoked as of Dec 9, 2025) to OIDC trusted publishing
Add id-token: write permission for GitHub Actions OIDC token generation
Upgrade to Node 24 which includes npm 11.5.1+ required for OIDC
Remove NPM_TOKEN / NODE_AUTH_TOKEN environment variables

Why

As of December 9, 2025, npm permanently revoked all classic tokens. This caused the 0.17.0 release to fail with:

npm error 404 Not Found - PUT https://registry.npmjs.org/@fission-ai%2fopenspec
npm notice Access token expired or revoked. Please try logging in again.

Benefits

No more token rotation - OIDC eliminates long-lived secrets
Automatic provenance - published packages get cryptographic attestation
Verified identity - npm cryptographically verifies the publisher

Required Manual Step

Before merging, configure trusted publisher on npm:

Go to npmjs.com/package/@fission-ai/openspec/access
Add GitHub Actions as trusted publisher:

Field Value

Organization Fission-AI

Repository OpenSpec

Workflow release-prepare.yml

Environment (leave blank)

Test plan

Configure trusted publisher on npm (manual step above)
Merge this PR
Create a changeset and merge to trigger release
Verify publish succeeds with OIDC

References

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated build and release infrastructure for improved security and compatibility.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Replace classic npm token authentication with OIDC trusted publishing: - Add `id-token: write` permission for OIDC token generation - Upgrade to Node 24 (includes npm 11.5.1+ required for OIDC) - Remove NPM_TOKEN/NODE_AUTH_TOKEN env vars (OIDC replaces them) This eliminates the need for rotating npm access tokens and provides cryptographically verified publisher identity with automatic provenance attestation. Requires configuring trusted publisher on npmjs.com: - Organization: Fission-AI - Repository: OpenSpec - Workflow: release-prepare.yml

coderabbitai · 2025-12-22T08:01:14Z

Walkthrough

Updated GitHub Actions workflow to adopt OIDC trusted publishing instead of explicit token-based authentication. Modified Node setup to version 24 with an npm 11.5.1+ requirement and removed npm authentication configurations.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Configuration `.github/workflows/release-prepare.yml`	Added `id-token: write` permission for OIDC support. Upgraded Node version to 24 with npm 11.5.1+ requirement note. Removed `scope` and `always-auth` npm configurations. Removed explicit `NPM_TOKEN` and `NODE_AUTH_TOKEN` environment variables; authentication now handled via OIDC.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Verify OIDC trusted publishing configuration is correctly aligned with npm registry requirements
Confirm Node 24 and npm version compatibility constraints are documented as needed
Validate that removal of explicit token configurations does not introduce authentication gaps in other workflows or contexts

Poem

🐰 A workflow so clean, with tokens no more,
OIDC trust now opens the door.
Node twenty-four hops right in place,
Securing our packages with elegant grace! ✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(ci): migrate to npm OIDC trusted publishing' accurately describes the main change—migrating from classic npm tokens to OIDC trusted publishing in the CI workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch feat/oidc-trusted-publishing

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c2a1a4c and cb3fa3a.

📒 Files selected for processing (1)

.github/workflows/release-prepare.yml

🔇 Additional comments (3)

.github/workflows/release-prepare.yml (3)

7-10: LGTM! Correctly configured OIDC permission.

The addition of id-token: write is required for GitHub Actions to generate OIDC tokens for npm trusted publishing. The inline comment clearly documents the purpose.

46-48: Critical: Ensure npm trusted publisher is configured before merging.

The removal of explicit npm tokens in favor of OIDC authentication is correct. However, per the PR objectives, the npm trusted publisher must be manually configured on npm.com before this PR can work:

Required configuration:

Package: @fission-ai/openspec

Organization: Fission-AI

Repository: OpenSpec

Workflow: release-prepare.yml

Environment: leave blank

Without this configuration, the publish step will fail even with OIDC tokens.

Please confirm the trusted publisher has been configured on npm before merging, or ensure this is clearly documented in the merge checklist.

29-33: Configuration supports OIDC trusted publishing.

Node.js 24 comes with npm 11, which satisfies the npm CLI version 11.5.1 or later requirement for trusted publishing. The registry-url is correctly retained for npm publishing, and removal of scope and always-auth settings is appropriate for OIDC workflows.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

@InQuirer

* feat(cli): add openspec config command for global configuration management (Fission-AI#382) * feat(cli): add openspec config command for global configuration management Implements the `openspec config` command with subcommands: - `path`: Show config file location - `list [--json]`: Show all current settings - `get <key>`: Get a specific value (raw output for scripting) - `set <key> <value> [--string]`: Set a value with auto type coercion - `unset <key>`: Remove a key (revert to default) - `reset --all [-y]`: Reset configuration to defaults - `edit`: Open config in $EDITOR/$VISUAL Key features: - Dot notation for nested key access (e.g., featureFlags.someFlag) - Auto type coercion (true/false → boolean, numbers → number) - --string flag to force string storage - Zod schema validation with unknown field passthrough - Reserved --scope flag for future project-local config - Windows-compatible editor spawning with proper path quoting - Shell completion registry integration * test(config): add additional unit tests for validation and coercion - Add tests for unknown fields with various types - Add test to verify error message path for featureFlags - Add test for number values rejection in featureFlags - Add config set simulation tests to verify full coerce → set → validate flow * fix(config): avoid shell parsing in config edit to handle paths with spaces Use spawn with shell: false and pass configPath as an argument instead of building a shell command string. This correctly handles spaces in both the EDITOR path and config file path on all platforms. * chore(openspec): archive add-config-command and create cli-config spec Move completed change to archive and apply spec deltas to create the cli-config specification documenting the config command interface. * Validate config keys on set * Add changeset for config command and shell completions (Fission-AI#388) * chore(release): version packages (Fission-AI#389) * Version Packages * chore: trigger CI --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Tabish Bidiwale <tabishbidiwale@gmail.com> * feat(ci): migrate to npm OIDC trusted publishing (Fission-AI#390) Replace classic npm token authentication with OIDC trusted publishing: - Add `id-token: write` permission for OIDC token generation - Upgrade to Node 24 (includes npm 11.5.1+ required for OIDC) - Remove NPM_TOKEN/NODE_AUTH_TOKEN env vars (OIDC replaces them) This eliminates the need for rotating npm access tokens and provides cryptographically verified publisher identity with automatic provenance attestation. Requires configuring trusted publisher on npmjs.com: - Organization: Fission-AI - Repository: OpenSpec - Workflow: release-prepare.yml * fix(cli): use dynamic import for @inquirer/prompts in config command (Fission-AI#392) * fix(cli): use dynamic import for @inquirer/prompts in config command The config command (added in Fission-AI#382) reintroduced the pre-commit hook hang issue that was fixed in Fission-AI#380. The static import of @inquirer/prompts at module load time causes stdin event listeners to be registered even when running non-interactive commands, preventing clean process exit when stdin is piped (as pre-commit does). Convert the static import to a dynamic import that only loads inquirer when the `config reset` command is actually used interactively. Fixes Fission-AI#367 * chore: add ESLint with no-restricted-imports rule for @InQuirer Add ESLint configuration that prevents static imports of @inquirer/* modules. This prevents future regressions of the pre-commit hook hang issue fixed in this PR. The rule shows a helpful error message pointing to issue Fission-AI#367 for context. init.ts is exempted since it's already dynamically imported from the CLI. * ci: add ESLint step to lint job Run `pnpm lint` in CI to enforce the no-restricted-imports rule that prevents static @InQuirer imports. * Add changeset for config command dynamic import fix (Fission-AI#393) * chore(release): version packages (Fission-AI#394) * Version Packages * chore: trigger CI --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Tabish Bidiwale <tabishbidiwale@gmail.com> * fix(cli): respect --no-interactive flag in validate command (Fission-AI#395) * fix(cli): respect --no-interactive flag in validate command The validate command's spinner was starting regardless of the --no-interactive flag, causing hangs in pre-commit hooks. Changes: - Pass noInteractive option to runBulkValidation - Handle Commander.js --no-* flag syntax (sets interactive=false) - Only start ora spinner when in interactive mode - Add CI environment variable check to isInteractive() for industry standard compliance * test: add unit tests for interactive utilities and CLI flag - Export resolveNoInteractive() helper for reuse - Add InteractiveOptions type export for testing - Refactor validate.ts to use resolveNoInteractive() - Add 17 unit tests for isInteractive() and resolveNoInteractive() - Add CLI integration test for --no-interactive flag This prevents future regressions where Commander.js --no-* flag parsing is not properly handled. * Add changeset for --no-interactive flag fix (Fission-AI#396) * chore(release): version packages (Fission-AI#397) * Version Packages * chore: trigger CI --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Tabish Bidiwale <tabishbidiwale@gmail.com> * docs: add artifact POC analysis document (Fission-AI#398) Add internal documentation for the artifact-based approach to OpenSpec core. This document outlines design decisions, terminology, and the philosophy behind treating dependencies as enablers rather than gates. * fix(archive): allow REMOVED requirements when creating new spec files (Fission-AI#403) (Fission-AI#404) When creating a new spec file, REMOVED requirements are now ignored with a warning instead of causing archive to fail. This enables refactoring scenarios where old fields are removed while documenting a capability for the first time. Fixes Fission-AI#403 --------- Co-authored-by: Tabish Bidiwale <30385142+TabishB@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Tabish Bidiwale <tabishbidiwale@gmail.com> Co-authored-by: Eunsong-Park <111448985+smileeunsong@users.noreply.github.com>

Replace classic npm token authentication with OIDC trusted publishing: - Add `id-token: write` permission for OIDC token generation - Upgrade to Node 24 (includes npm 11.5.1+ required for OIDC) - Remove NPM_TOKEN/NODE_AUTH_TOKEN env vars (OIDC replaces them) This eliminates the need for rotating npm access tokens and provides cryptographically verified publisher identity with automatic provenance attestation. Requires configuring trusted publisher on npmjs.com: - Organization: Fission-AI - Repository: OpenSpec - Workflow: release-prepare.yml

Merge branch 'main' into feat/oidc-trusted-publishing

32f3acf

TabishB merged commit 6de04f3 into main Dec 22, 2025
7 checks passed

TabishB mentioned this pull request Dec 22, 2025

chore: add changeset for config command dynamic import fix #393

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(ci): migrate to npm OIDC trusted publishing #390

feat(ci): migrate to npm OIDC trusted publishing #390

Uh oh!

TabishB commented Dec 22, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Dec 22, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Field	Value
Organization	`Fission-AI`
Repository	`OpenSpec`
Workflow	`release-prepare.yml`
Environment	(leave blank)

feat(ci): migrate to npm OIDC trusted publishing #390

feat(ci): migrate to npm OIDC trusted publishing #390

Uh oh!

Conversation

TabishB commented Dec 22, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Benefits

Required Manual Step

Test plan

References

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks and finishing touches

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

TabishB commented Dec 22, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Dec 22, 2025 •

edited

Loading