enable oidc publishing #1015

travi · 2025-10-14T14:46:08Z

this doesnt yet handle:

publishing to an alternative registry from a custom pkgRoot because of the added dry-run
including node v24 in the verification matrix on ci (but i have separately confirmed that the released version works fine in v24)

since oidc removes the need for the token for #958

since oidc does not currently work for whoami for #958

BREAKING CHANGE: v25 of semantic-release is now expected for #958

This reverts commit 156b6c8.

…the oidc features are merged

…ions

… oidc

… specific

…publishing

…string

…gistry for #958

for #958

…upported ci providers for #958

… required when not using OIDC for #958

github-actions · 2025-10-14T16:56:10Z

🎉 This PR is included in version 13.1.0-alpha.2 🎉

The release is available on:

Your semantic-release bot 📦🚀

for #958

github-actions · 2025-10-14T16:58:17Z

🎉 This PR is included in version 13.1.0-alpha.3 🎉

The release is available on:

Your semantic-release bot 📦🚀

…b actions for both trusted publishing and provenance attestations for #958

…ctions for #958

github-actions · 2025-10-15T16:30:12Z

🎉 This PR is included in version 13.1.0-alpha.8 🎉

The release is available on:

Your semantic-release bot 📦🚀

…context of github actions for #958

github-actions · 2025-10-15T17:08:12Z

🎉 This PR is included in version 13.1.0-alpha.9 🎉

The release is available on:

Your semantic-release bot 📦🚀

…ipelines for #958

github-actions · 2025-10-15T17:31:21Z

🎉 This PR is included in version 13.1.0-alpha.10 🎉

The release is available on:

Your semantic-release bot 📦🚀

since that logic is now handled with the step to acquire the id-token for #958

for #958

github-actions · 2025-10-15T18:59:03Z

🎉 This PR is included in version 13.1.0-alpha.11 🎉

The release is available on:

Your semantic-release bot 📦🚀

for #958

github-actions · 2025-10-15T19:22:49Z

🎉 This PR is included in version 13.1.0-alpha.12 🎉

The release is available on:

Your semantic-release bot 📦🚀

…ing context for #958

github-actions · 2025-10-15T19:31:30Z

🎉 This PR is included in version 13.1.0-alpha.13 🎉

The release is available on:

Your semantic-release bot 📦🚀

…ithin GitLab Pipelines for #958

since stubbing `@actions/core` breaks in that version and i don't want figuring that out to delay getting the trusted-publishing feature out for #958

travi · 2025-10-16T03:10:48Z

i'm going to go ahead and promote this to beta status. we can do a proper review before promoting to stable, but i want to signal that this is now production quality and ready for community testing by promoting to beta. there are still a few details to get buttoned up, but those changes can be applied to the beta

github-actions · 2025-10-16T03:12:38Z

🎉 This PR is included in version 13.1.0-beta.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

github-actions · 2025-10-19T16:06:50Z

🎉 This PR is included in version 13.1.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

travi added 19 commits July 8, 2025 23:49

ci(release): enable triggering for the alpha branch

eba6518

fix(deps): depend on the oidc branch for npm

733fe89

fix(token): temporarily disable configuring token into .npmrc

73185a3

since oidc removes the need for the token for #958

fix(whoami): temporarily disable verifying token validity

0fc050d

since oidc does not currently work for whoami for #958

fix: raise the minimum semantic-release requirement to v25

156b6c8

BREAKING CHANGE: v25 of semantic-release is now expected for #958

Revert "fix: raise the minimum semantic-release requirement to v25"

65dffca

This reverts commit 156b6c8.

fix(deps): depend on the released version of the cli branch now that …

fc30c21

…the oidc features are merged

feat(auth): attempt a dry-run publish to determine auth status

841dc67

fix(auth): throw error if dry-run publish determines lack of auth

8f88e9d

fix(error): throw an aggregate error rather than a simple error

1967d72

fix(stdout): fix the reference of stdout from execa

4ab3e74

fix(dry-run): look for the warning in stderr output rather than stdout

86f65a6

fix(dry-run): stop searching for "warn" to avoid ANSI color complicat…

bee5db6

…ions

docs(oidc): update the authentication details to include recommending…

9bdfd06

… oidc

feat(auth-error): updated messaging for auth failure to be less token…

e24967d

… specific

fix(auth): throw appropriate error when auth context fails to enable …

f5c8d85

…publishing

feat(verify-auth): configure npmrc details again

bd7acfb

Merge branch 'beta' of github.com:semantic-release/npm into alpha

197693e

Merge branch 'master' of github.com:semantic-release/npm into alpha

761d4db

travi force-pushed the alpha branch from dae854a to 012dba3 Compare October 14, 2025 15:32

travi added 2 commits October 14, 2025 10:37

refactor(registry): extract a constant rather than repeating the url …

dd9ea86

…string

wip(trusted-publishing): capture rule about targeting the official re…

18b5911

…gistry for #958

travi force-pushed the alpha branch from 012dba3 to 18b5911 Compare October 14, 2025 15:37

travi added 3 commits October 14, 2025 10:55

wip(trusted-publishing): detect whether running from a trusted provider

1e279d8

for #958

wip(trusted-publishing): limit successful oidc context detection to s…

00ab5fc

…upported ci providers for #958

feat(trusted-publishing): highlight in the error that a token is only…

a2aa38f

… required when not using OIDC for #958

github-actions bot added the released on @alpha label Oct 14, 2025

fix(errors): bring back the invalid token error

c9f0da5

for #958

travi added 2 commits October 15, 2025 09:11

docs(trusted-publsihing): combine information about configuring githu…

66e2a44

…b actions for both trusted publishing and provenance attestations for #958

feat(trusted-publishing): pass id-token as bearer header for github a…

d83b727

…ctions for #958

travi added 3 commits October 15, 2025 11:36

refactor(token-exchange): rename the function to be verb focused

701510e

Merge branch 'master' of github.com:semantic-release/npm into alpha

f063ab4

feat(trusted-publishing): handle failure to retrieve id-token in the …

b673257

…context of github actions for #958

feat(trusted-publishing): pass id-token as bearer header for gitlab p…

6d1c3cf

…ipelines for #958

travi added 2 commits October 15, 2025 12:36

refactor(trusted-publishing): remove redundant ci-providers check

cf9011b

since that logic is now handled with the step to acquire the id-token for #958

fix(verify-auth): stream output of the dry-run for custom registries

67ee603

for #958

feat(trusted-publishing): log progression of token-exchange steps

a4a5add

for #958

fix(trusted-publishing): properly await the check for trusted publish…

23c8610

…ing context for #958

travi added 3 commits October 15, 2025 15:01

docs(trusted-publishing): add details to the readme for configuring w…

e5c9857

…ithin GitLab Pipelines for #958

refactor: resolve prettier issues

38b0466

ci(node-versions): disable node v24 from the verification matrix for now

d351eca

since stubbing `@actions/core` breaks in that version and i don't want figuring that out to delay getting the trusted-publishing feature out for #958

travi force-pushed the alpha branch from 30c6dcb to d351eca Compare October 16, 2025 03:04

travi changed the base branch from master to beta October 16, 2025 03:08

travi marked this pull request as ready for review October 16, 2025 03:09

travi merged commit a160d8d into beta Oct 16, 2025
2 of 6 checks passed

travi deleted the alpha branch October 16, 2025 03:11

github-actions bot added the released on @beta label Oct 16, 2025

travi mentioned this pull request Oct 16, 2025

promote to beta semantic-release/semantic-release#3905

Merged

github-actions bot added the released label Oct 19, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

enable oidc publishing #1015

enable oidc publishing #1015

Uh oh!

travi commented Oct 14, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 14, 2025

Uh oh!

github-actions bot commented Oct 14, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

travi commented Oct 16, 2025 •

edited by hearts bot

Loading

Uh oh!

Uh oh!

github-actions bot commented Oct 16, 2025

Uh oh!

github-actions bot commented Oct 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

enable oidc publishing #1015

enable oidc publishing #1015

Uh oh!

Conversation

travi commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Oct 14, 2025

Uh oh!

github-actions bot commented Oct 14, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

travi commented Oct 16, 2025 • edited by hearts bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 16, 2025

Uh oh!

github-actions bot commented Oct 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

travi commented Oct 14, 2025 •

edited

Loading

travi commented Oct 16, 2025 •

edited by hearts bot

Loading