Skip to content

npm oidc #1201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hortison merged 1 commit into from
Jan 9, 2026
Merged

npm oidc #1201

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 16 additions & 18 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,3 @@
# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages

name: Publish Node.js Package

on:
Expand All @@ -9,43 +6,44 @@ on:
env:
HUSKY: 0

permissions:
id-token: write # Required for OIDC
contents: read

jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
runs-on: ubuntu-24.04

- uses: actions/setup-node@v3
with:
node-version: '20.x'
permissions:
id-token: write # Required for OIDC trusted publishing
contents: write
Comment on lines 14 to +19
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The build job is now empty with no steps defined. An empty job will fail to execute. Either remove this job entirely or add the necessary steps (checkout and setup-node at minimum).

Copilot uses AI. Check for mistakes.

publish-gpr:
needs: build
runs-on: ubuntu-latest
publish:
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's a syntax error: incorrect indentation for the publish job. The job name should align with 'build' above (2 spaces), but it has 3 spaces. This will cause a YAML parsing error.

Suggested change
publish:
publish:

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The publish job permissions include 'packages: write' which is for GitHub Packages, but this workflow is publishing to npm registry. For OIDC trusted publishing to npm, you need 'id-token: write' permission instead. The 'packages: write' permission should be removed as it's not relevant for npm publishing.

Suggested change
packages: write
id-token: write # Required for OIDC trusted publishing to npm

Copilot uses AI. Check for mistakes.
steps:
- uses: actions/checkout@v4

Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The publish job is missing the checkout step (actions/checkout). This step is required to check out the repository code before setting the package version, installing dependencies, building, and publishing. Without it, the workflow will fail as there will be no code to work with.

Suggested change
- uses: actions/checkout@v4

Copilot uses AI. Check for mistakes.
- name: "Set Package Version"
uses: reedyuk/npm-version@1.1.1
with:
version: ${{ github.event.release.tag_name }}

- uses: actions/setup-node@v3
- uses: actions/setup-node@v6
with:
node-version: '20.x'
node-version: '24'
registry-url: "https://registry.npmjs.org"
scope: "@sistent"
- run: |
npm install
npm run build
npm publish --verbose
npm publish --provenance --access public --verbose
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: '' # Explicitly empty for install
Comment on lines 42 to +43
Copy link

Copilot AI Jan 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting NODE_AUTH_TOKEN to an empty string will prevent npm authentication. For OIDC trusted publishing to work, you should either omit the NODE_AUTH_TOKEN environment variable entirely or configure it properly. When using OIDC with --provenance flag, npm will use the OIDC token automatically and NODE_AUTH_TOKEN should not be set.

Copilot uses AI. Check for mistakes.

versions-check:
needs: publish-gpr
needs: publish
runs-on: ubuntu-latest
steps:
- uses: actions/github-script@v7
Expand Down
Loading