Replace npm token auth with OIDC trusted publishing #656

Copilot · 2026-01-06T13:31:04Z

npm classic tokens were revoked as of December 2025. This updates the CI workflow to use OIDC trusted publishing for npm package publishing.

Changes

Add id-token: write permission for OIDC authentication
Add registry-url: 'https://registry.npmjs.org' to actions/setup-node in publish jobs
Replace JS-DevTools/npm-publish action with direct npm publish CLI command
Use Node.js 22.x in publish jobs (bundled npm v11.x has OIDC trusted publishing support)
Move dependabot exclusion checks to job-level if conditions

Required Setup

Configure trusted publisher on npmjs.com for this package:

Repository: SolidOS/solid-ui
Workflow filename: ci.yml

Original prompt

On ci.yml, Please update this configuration to replace use of token based authentication with OIDC session management

https://github.blog/changelog/2025-12-09-npm-classic-tokens-revoked-session-based-auth-and-cli-token-management-now-available/

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: jeswr <63333554+jeswr@users.noreply.github.com>

jeswr · 2026-01-06T13:55:37Z

@copilot please update the workflow to use the npm cli directly as shown in https://docs.npmjs.com/trusted-publishers and remove the use of the JS-DevTools action

Co-authored-by: jeswr <63333554+jeswr@users.noreply.github.com>

Copilot · 2026-01-06T14:00:01Z

@copilot please update the workflow to use the npm cli directly as shown in https://docs.npmjs.com/trusted-publishers and remove the use of the JS-DevTools action

Updated to use npm publish directly instead of JS-DevTools action. The workflow now installs npm v11.5.1+ (required for OIDC support) and calls npm publish --tag <tag> for both publish jobs. See commit af3d10a.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

docs.npmjs.com
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

jeswr · 2026-01-06T14:21:37Z

@copilot Please use actions/setup-node rather than npm i -g npm

Co-authored-by: jeswr <63333554+jeswr@users.noreply.github.com>

Copilot · 2026-01-06T14:24:32Z

@copilot Please use actions/setup-node rather than npm i -g npm

Updated to use node-version: 22.x in actions/setup-node instead of npm i -g npm. Node.js 22 comes bundled with npm v11.x which supports OIDC trusted publishing. See commit 6b3bb08.

…ore merging

Added steps to clear npm token configuration Changed the verification to warn instead of fail (so you can see the issue) Added instructions in the logs about removing the secret

Copilot

Pull request overview

This PR updates the CI workflow to use OIDC trusted publishing for npm package publishing, replacing deprecated npm classic token authentication that was revoked in December 2025.

Changes:

Migrated from token-based authentication (NPM_TOKEN secret) to OIDC trusted publishing for npm
Updated Node.js versions to 22.x and 24.x to support npm v10+ with OIDC capabilities
Added extensive verification and debugging steps to ensure OIDC authentication works correctly

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
`.github/workflows/ci.yml`	Added OIDC permissions, registry URL configuration, token cleanup steps, and replaced `JS-DevTools/npm-publish` action with direct `npm publish` CLI commands
`package.json`	Simplified repository URL format by removing `git+` prefix

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-13T11:09:30Z

.github/workflows/ci.yml

+      - name: Clear NODE_AUTH_TOKEN and npm token config to force OIDC
+        run: |
+          # Remove any .npmrc file that might contain token auth
+          if [ -f "$HOME/.npmrc" ]; then
+            echo "Found .npmrc at $HOME/.npmrc, checking for token auth..."
+            if grep -q "_authToken" "$HOME/.npmrc"; then
+              echo "Removing token auth from .npmrc..."
+              sed -i '/_authToken/d' "$HOME/.npmrc" || true
+            fi
+          fi
+          # Clear npm config token settings
+          npm config delete //registry.npmjs.org/:_authToken || true
+          npm config delete _authToken || true
+          # Note: NODE_AUTH_TOKEN env var from secrets will still be available
+          # but npm should prefer OIDC when configured correctly
+          echo "Cleared npm token configuration"


This step manipulates npm configuration files and settings to work around potential conflicts with OIDC. The extensive token cleanup logic is duplicated in both publish jobs and suggests the workflow might be fighting against the environment setup. Consider removing the NODE_AUTH_TOKEN secret from the repository instead of working around it in the workflow.

Copilot · 2026-01-13T11:09:30Z

.github/workflows/ci.yml

+      - name: Verify OIDC authentication
+        run: |
+          echo "Workflow name: ${{ github.workflow }}"
+          echo "Workflow file: ${{ github.workflow_ref }}"
+          echo "Repository: ${{ github.repository }}"
+          echo "Ref: ${{ github.ref }}"
+          echo "Actor: ${{ github.actor }}"
+          echo "Event name: ${{ github.event_name }}"
+          # Check if NODE_AUTH_TOKEN is set (from repository secrets)
+          if [ -n "$NODE_AUTH_TOKEN" ]; then
+            echo "WARNING: NODE_AUTH_TOKEN secret is configured in repository"
+            echo "This will prevent OIDC from working. Please remove the NODE_AUTH_TOKEN secret"
+            echo "from repository Settings > Secrets and variables > Actions"
+            echo ""
+            echo "For now, we'll try to work around it by clearing npm config..."
+            # Don't exit - try to work around it
+          else
+            echo "✓ No NODE_AUTH_TOKEN secret found (good for OIDC)"
+          fi
+          # Check if ACTIONS_ID_TOKEN_REQUEST_TOKEN is available (required for OIDC)
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_TOKEN" ]; then
+            echo "WARNING: ACTIONS_ID_TOKEN_REQUEST_TOKEN not set - OIDC may not work"
+          else
+            echo "✓ OIDC token request token is available"
+          fi


The extensive verification steps for OIDC authentication (lines 107-235) are duplicated in both npm-publish-build and npm-publish-latest jobs. Consider extracting this logic into a reusable composite action or a shared shell script to reduce duplication and improve maintainability.

Copilot · 2026-01-13T11:09:30Z

.github/workflows/ci.yml

+      - name: Test npm publish (dry-run) - PRs only
+        if: github.event_name == 'pull_request'
+        run: |
+          echo "Testing npm publish authentication with dry-run..."
+          echo "This verifies OIDC authentication works without actually publishing"
+          npm publish --dry-run --tag ${{ env.GITHUB_REF_SLUG }} || {
+            echo "ERROR: npm publish dry-run failed"
+            echo "This indicates OIDC authentication is not working correctly"
+            exit 1
+          }
+          echo "✓ npm publish dry-run succeeded - OIDC authentication is working!"


The dry-run test will fail on pull requests because OIDC authentication tokens are only issued for trusted events (push to main, tags, etc.), not for pull_request events. This check should either be removed or the condition should be adjusted to skip it for pull requests, as OIDC authentication cannot be verified in PR contexts.

Suggested change

- name: Test npm publish (dry-run) - PRs only

if: github.event_name == 'pull_request'

run: |

echo "Testing npm publish authentication with dry-run..."

echo "This verifies OIDC authentication works without actually publishing"

npm publish --dry-run --tag ${{ env.GITHUB_REF_SLUG }} || {

echo "ERROR: npm publish dry-run failed"

echo "This indicates OIDC authentication is not working correctly"

exit 1

}

echo "✓ npm publish dry-run succeeded - OIDC authentication is working!"

- name: Skip npm publish dry-run on PRs (OIDC not available)

if: github.event_name == 'pull_request'

run: |

echo "Skipping npm publish dry-run on pull_request events."

echo "OIDC tokens are only issued for trusted events (e.g., push to main, tags, workflow_dispatch),"

echo "so npm publish authentication cannot be verified in PR contexts."

echo "This step is intentionally a no-op for pull requests."

Copilot · 2026-01-13T11:09:31Z

.github/workflows/ci.yml

+        run: |
+          # Remove any .npmrc file that might contain token auth
+          if [ -f "$HOME/.npmrc" ]; then
+            echo "Found .npmrc at $HOME/.npmrc, checking for token auth..."
+            if grep -q "_authToken" "$HOME/.npmrc"; then
+              echo "Removing token auth from .npmrc..."
+              sed -i '/_authToken/d' "$HOME/.npmrc" || true
+            fi
+          fi
+          # Clear npm config token settings
+          npm config delete //registry.npmjs.org/:_authToken || true
+          npm config delete _authToken || true
+          # Note: NODE_AUTH_TOKEN env var from secrets will still be available
+          # but npm should prefer OIDC when configured correctly
+          echo "Cleared npm token configuration"


This token cleanup logic is duplicated from the npm-publish-build job (lines 86-101). Extract this into a reusable composite action or shell script to eliminate the duplication.

Suggested change

run: |

# Remove any .npmrc file that might contain token auth

if [ -f "$HOME/.npmrc" ]; then

echo "Found .npmrc at $HOME/.npmrc, checking for token auth..."

if grep -q "_authToken" "$HOME/.npmrc"; then

echo "Removing token auth from .npmrc..."

sed -i '/_authToken/d' "$HOME/.npmrc" || true

fi

fi

# Clear npm config token settings

npm config delete //registry.npmjs.org/:_authToken || true

npm config delete _authToken || true

# Note: NODE_AUTH_TOKEN env var from secrets will still be available

# but npm should prefer OIDC when configured correctly

echo "Cleared npm token configuration"

run: .github/scripts/clear-npm-token.sh

- Addressed dry-run comment

bourgeoa · 2026-01-13T14:15:36Z

@PreciousOritsedere @jeswr
did you try npm publish --access public this should avoid the creation of NODE_AUTH_TOKEN by. NPM
See https://dev.to/zhangjintao/from-deprecated-npm-classic-tokens-to-oidc-trusted-publishing-a-cicd-troubleshooting-journey-4h8b

PreciousOritsedere · 2026-01-13T14:19:31Z

https://dev.to/zhangjintao/from-deprecated-npm-classic-tokens-to-oidc-trusted-publishing-a-cicd-troubleshooting-journey-4h8b

Thank you, let me try this now

- Added --access public flag

Initial plan

b090875

Copilot AI assigned Copilot and jeswr Jan 6, 2026

Copilot started work on behalf of jeswr January 6, 2026 13:31 View session

Copilot AI and others added 2 commits January 6, 2026 13:34

Replace npm token auth with OIDC trusted publishing

dfc2638

Co-authored-by: jeswr <63333554+jeswr@users.noreply.github.com>

Fix trailing whitespace in ci.yml

c737309

Co-authored-by: jeswr <63333554+jeswr@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update ci.yml for OIDC session management~~ Replace npm token auth with OIDC trusted publishing Jan 6, 2026

Copilot AI requested a review from jeswr January 6, 2026 13:36

Copilot finished work on behalf of jeswr January 6, 2026 13:36

Copilot started work on behalf of jeswr January 6, 2026 13:56 View session

jeswr mentioned this pull request Jan 6, 2026

chore: delete NPM_TOKEN #655

Closed

Copilot AI and others added 2 commits January 6, 2026 13:57

Use npm CLI directly instead of JS-DevTools action

e7878f9

Co-authored-by: jeswr <63333554+jeswr@users.noreply.github.com>

Pin npm version to ^11.5.1 for OIDC support

af3d10a

Co-authored-by: jeswr <63333554+jeswr@users.noreply.github.com>

Copilot finished work on behalf of jeswr January 6, 2026 14:00

Copilot started work on behalf of jeswr January 6, 2026 14:22 View session

Use Node.js 22 from setup-node instead of npm install

6b3bb08

Co-authored-by: jeswr <63333554+jeswr@users.noreply.github.com>

Copilot finished work on behalf of jeswr January 6, 2026 14:25

jeswr added 4 commits January 6, 2026 17:04

Add Node.js 24.x to CI workflow

cbff3cf

Update package.json

1dfb900

Check npm version check before publishing

dbbf23d

Add npm version check to CI workflow

74d44c4

jeswr mentioned this pull request Jan 7, 2026

Add support for parsing reified triples and triple terms rdfjs/N3.js#486

Merged

PreciousOritsedere and others added 4 commits January 13, 2026 10:12

update workflow for npm trusted publishing

7ef6381

Merge branch 'main' into copilot/update-ci-yml-auth-method

fd452ce

added a dry-run publish step to verify OIDC authentication on PRs bef…

5579241

…ore merging

What I've updated in the workflow

40beb81

Added steps to clear npm token configuration Changed the verification to warn instead of fail (so you can see the issue) Added instructions in the logs about removing the secret

PreciousOritsedere marked this pull request as ready for review January 13, 2026 11:08

Copilot AI review requested due to automatic review settings January 13, 2026 11:08

Copilot AI reviewed Jan 13, 2026

View reviewed changes

- Created reusable scripts (addressing duplication)

727190e

- Addressed dry-run comment

- Added script verification ste

10d1bef

- Added --access public flag

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Replace npm token auth with OIDC trusted publishing #656

Replace npm token auth with OIDC trusted publishing #656

Copilot AI commented Jan 6, 2026 •

edited

Loading

Uh oh!

jeswr commented Jan 6, 2026

Uh oh!

Copilot AI commented Jan 6, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

jeswr commented Jan 6, 2026

Uh oh!

Copilot AI commented Jan 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 13, 2026

Uh oh!

Copilot AI Jan 13, 2026

Uh oh!

Copilot AI Jan 13, 2026

Uh oh!

Copilot AI Jan 13, 2026

Uh oh!

bourgeoa commented Jan 13, 2026 •

edited

Loading

Uh oh!

PreciousOritsedere commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Replace npm token auth with OIDC trusted publishing #656

Are you sure you want to change the base?

Replace npm token auth with OIDC trusted publishing #656

Conversation

Copilot AI commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Required Setup

Uh oh!

jeswr commented Jan 6, 2026

Uh oh!

Copilot AI commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

jeswr commented Jan 6, 2026

Uh oh!

Copilot AI commented Jan 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 13, 2026

Choose a reason for hiding this comment

Uh oh!

bourgeoa commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PreciousOritsedere commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jan 6, 2026 •

edited

Loading

Copilot AI commented Jan 6, 2026 •

edited

Loading

bourgeoa commented Jan 13, 2026 •

edited

Loading