ci(release): adopt npm staged publishing via OIDC#87
Merged
Conversation
Switches the npm-publish job to `npm stage publish` so the GitHub Actions workflow uploads tarballs to npm's staging queue. A maintainer then approves each staged version with 2FA from npmjs.com or the npm CLI before it becomes installable. The previous direct-publish flow was failing with `OIDC permission denied for this action` against npm's post-2026-05-20 trusted-publisher rules, which require the allowed-action checkbox(es) to be explicit. Each of the 15 packages needs a trusted publisher configured on npmjs.com (SocketDev/socket-patch → release.yml) with both `npm publish` and `npm stage publish` allowed; the workflow uses stage-publish for every release. Workflow changes: - Bump actions/setup-node to v6.4.0 + package-manager-cache: false (eliminates the always-auth deprecation warning emitted by v4). - Replace `npm publish --provenance --access public` with `npm stage publish --access public`. OIDC trusted publishing emits provenance automatically, so --provenance is now redundant. - Collect successfully staged package names and write a step summary with org-dashboard and per-package review links, plus a ::notice:: pointing at the staged-packages dashboard, so maintainers can click straight from the workflow run page into the approval UI. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wenxin Jiang (Wenxin-Jiang)
approved these changes
May 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm-publishtonpm stage publishso releases go through npm's staging queue and require a 2FA-gated human approval before becoming installable.actions/setup-nodeto v6.4.0 withpackage-manager-cache: false(kills thealways-authdeprecation warning from v4).--provenance— OIDC trusted publishing emits provenance automatically.::notice::pointing maintainers straight at the staged-packages dashboard.Why
The previous release failed with
403 OIDC permission denied for this actionbecause npm's trusted-publisher rules (effective 2026-05-20) require the allowed-action checkbox to be explicit, and directnpm publishfrom CI is no longer the recommended path for trusted-publisher-driven workflows. Staged publishing pairs with trusted publishing to give "proof of presence" on every release — a stolen OIDC token cannot ship a malicious version without a maintainer's 2FA approval.Required manual setup (one-time, per package)
For each of the 15 packages, visit
https://www.npmjs.com/package/@socketsecurity/<pkg>/accessand configure a Trusted Publisher:SocketDevsocket-patchrelease.ymlnpm publishand ✅npm stage publishPackages:
socket-patch,socket-patch-android-arm64,socket-patch-darwin-{arm64,x64},socket-patch-linux-{arm,arm64,ia32,x64}-{gnu,musl},socket-patch-win32-{arm64,ia32,x64}.Without this, the workflow will still 403.
Maintainer approval flow (per release)
After the workflow finishes, the run page's step summary lists every staged version with its review URL. Approve platform packages first (so
optionalDependenciesresolution sees binaries when the main package goes live), then the main@socketsecurity/socket-patchpackage. Two paths:npm stage listthennpm stage approve <stage-id>per package (requiresnpm@11.15.0+locally + 2FA device).npm stage approvecannot use OIDC tokens by design, so this step is necessarily a human + 2FA action.Cleanup follow-up
The previous failing run showed
NODE_AUTH_TOKEN: XXXXX-...getting auto-injected from an org/repo secret of that name. With OIDC it's unused (npm 11.15.0+ prefers OIDC env vars over_authToken), but the secret should eventually be deleted to remove the fallback path.Test plan
Cargo.tomlto a new patch version + addCHANGELOG.mdentry.Releaseworkflow withdry-run: false.npm-publishjob succeeds with noalways-authwarning and no 403.npm install @socketsecurity/socket-patch@<new-version>resolves with the right binary and shows "Built and signed on GitHub Actions" provenance in the UI.🤖 Generated with Claude Code