Remove NPM_TOKEN to OIDC publish workflow since the skip-2fa npm toke…

.github/composite/setup/action.yaml

@@ -16,41 +16,9 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Export GitHub Token
-      shell: bash
-      run: echo "GH_TOKEN=${{ inputs.GITHUB_TOKEN }}" >> $GITHUB_ENV
-
-    - name: Disable man-db
-      shell: bash
-      run: sudo bash -ec 'echo "set man-db/auto-update false" | debconf-communicate; dpkg-reconfigure man-db'
-
-    - uses: oven-sh/setup-bun@v2
+    - name: Setup
+      uses: tahminator/pipeline/actions/setup@1.0.17
       with:
-        bun-version: latest
-
-    - name: Cache Bun dependencies
-      uses: actions/cache@v5
-      with:
-        path: ~/.bun/install/cache
-        key: ${{ runner.os }}-bun-${{ hashFiles('.github/scripts/bun.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-bun-
-
-    - name: Install deps
-      shell: bash
-      run: bun install --cwd .github/scripts --frozen-lockfile
-
-    - name: Test CI scripts
-      shell: bash
-      run: bun run --cwd .github/scripts test
-
-    - name: Load GPG secret key
-      uses: crazy-max/ghaction-import-gpg@v6
-      if: inputs.GPG_PRIVATE_KEY != '' && inputs.GPG_PASSPHRASE != ''
-      with:
-        gpg_private_key: ${{ inputs.GPG_PRIVATE_KEY }}
-        passphrase: ${{ inputs.GPG_PASSPHRASE }}
-
-    - name: Install git-crypt
-      if: inputs.GPG_PRIVATE_KEY != '' && inputs.GPG_PASSPHRASE != ''
-      uses: flydiverny/setup-git-crypt@v4
+        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
+        GITHUB_TOKEN: ${{ inputs.GITHUB_TOKEN }}

.github/scripts/package.json

@@ -17,7 +17,7 @@
   "license": "MIT",
   "dependencies": {
     "@octokit/rest": "^22.0.1",
-    "@tahminator/pipeline": "^1.0.9",
+    "@tahminator/pipeline": "^1.0.16",
     "@types/yargs": "^17.0.35",
     "bun": "^1.3.6",
     "octokit": "^5.0.5",

.github/scripts/src/upload-npm/index.ts

@@ -1,25 +1,11 @@
 import { NPMClient } from "@tahminator/pipeline";
-import { Utils } from "@tahminator/pipeline";
 
 async function main() {
-  const { npmToken } = parseCiEnv(await Utils.getEnvVariables(["ci"]));
-  await using npmClient = await NPMClient.create(npmToken);
+  await using npmClient = await NPMClient.create();
 
   await npmClient.publish();
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
-  const npmToken = (() => {
-    const v = ciEnv["NPM_TOKEN"];
-    if (!v) {
-      throw new Error("Missing NPM_TOKEN from .env.ci");
-    }
-    return v;
-  })();
-
-  return { npmToken };
-}
-
 main()
   .then(() => {
     process.exit(0);

.github/workflows/cd.yaml

@@ -4,6 +4,7 @@ run-name: Running continuous deployment on ${{ github.actor }}'s commits
 
 permissions:
   contents: read
+  id-token: write
 
 on:
   push:
@@ -31,7 +32,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24" # to be used for npm publish via OIDC
           cache: "pnpm"
 
       - name: Install Dependencies

package.json

@@ -1,7 +1,11 @@
 {
   "name": "@tahminator/sapling",
-  "version": "1.5.0",
+  "version": "0.0.0",
+  "author": "Tahmid Ahmed",
   "description": "A library to help you write cleaner Express.js code",
+  "repository": {
+    "url": "git+https://github.com/tahminator/pipeline.git"
+  },
   "scripts": {
     "test": "pnpm run build",
     "build": "rm -rf dist && tsc"
@@ -20,7 +24,6 @@
     "/dist"
   ],
   "keywords": [],
-  "author": "Tahmid Ahmed",
   "license": "ISC",
   "packageManager": "pnpm@10.12.4",
   "dependencies": {