From c8c20757ea40fba2e66ce2842d39ee4735d8eaea Mon Sep 17 00:00:00 2001 From: rom1504 Date: Sat, 28 Mar 2026 16:58:27 +0000 Subject: [PATCH] Switch to trusted publishing via OIDC - Add id-token: write permission for OIDC trusted publishing - Use Node 24 (ships npm 11.11.0, trusted publishing requires >=11.5.1) - Add registry-url for OIDC auth flow - Upgrade JS-DevTools/npm-publish from v1 to v4 - Remove NPM_AUTH_TOKEN (no longer needed) Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/publish.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e083dc5..463a62a 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3,6 +3,9 @@ on: push: branches: - master # Change this to your default branch +permissions: + id-token: write + contents: write jobs: npm-publish: name: npm-publish @@ -15,11 +18,10 @@ jobs: - name: Set up Node.js uses: actions/setup-node@master with: - node-version: 22.0.0 + node-version: 24 + registry-url: 'https://registry.npmjs.org' - id: publish - uses: JS-DevTools/npm-publish@v1 - with: - token: ${{ secrets.NPM_AUTH_TOKEN }} + uses: JS-DevTools/npm-publish@v4 - name: Create Release if: steps.publish.outputs.type != 'none' id: create_release