ci(release): switch npm publish to OIDC Trusted Publishing - #161
Merged
Conversation
The NPM_TOKEN secret (granular access token, 30-day default expiry) expired between v0.0.13 and the v0.0.14 attempt, surfacing as 404 PUT errors on all three @simple-module-py/* publishes. Rotating again just restarts the clock. Switch the publish-npm matrix to OIDC, matching the PyPI side: each job mints a short-lived id-token, exchanges it with npm, and publishes without a long-lived secret. Drops the manual .npmrc auth step and the NPM_TOKEN env on the publish step, and pins npm to the latest CLI since Node 24's bundled npm may lag behind the 11.5.1 minimum for OIDC. Requires Trusted Publisher config on each package's npm settings page (org=antosubash, repo=simple_module_python, workflow=release.yml, environment=npm) before the next release run.
Deploying simple-module-python with
|
| Latest commit: |
927c9bf
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b845c389.simple-module-python.pages.dev |
| Branch Preview URL: | https://fix-release.simple-module-python.pages.dev |
- Drop `npm install -g npm@latest` — Node 24.15.0 already ships npm 11.12.1 (well above the 11.5.1 floor for Trusted Publishing); the step was ~5-15s of waste per matrix job, and the comment claim that "Node 24's bundled npm may lag" was empirically wrong. - Add `contents: read` to publish-npm's job-level permissions block. Job-level permissions replace (not merge with) workflow-level perms, so the previous block silently set `contents: none` — fine today, but a footgun for any future cache:/checkout: step. - Mirror least-privilege on publish-pypi for symmetry: same OIDC scope, drops the inherited `contents: write` it never needed. - Fix stale top-level comment that still claimed "npm uses NPM_TOKEN".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
NPM_TOKENgranular access token expired between v0.0.13 (2026-05-15) and the v0.0.14 attempt (2026-05-21), surfacing as404 PUTerrors on all three@simple-module-py/*publishes in run 26224490850. Rotating a new token just restarts the ~30-day clock.publish-npmmatrix to npm's OIDC Trusted Publishing (GA since Jul 2025), matching the PyPI side. Each job mints a short-lived id-token, exchanges it with npm, and publishes — no long-lived secret.@latestbecause Node 24's bundled npm may sit below the 11.5.1 minimum for OIDC. Drops the manual.npmrcstep and theNPM_TOKENenv on the publish step.Configure Trusted Publisher on each package's npm settings page — without this, the next release will fail because npm has no record that this repo is allowed to OIDC-publish:
For each: Trusted Publisher → GitHub Actions, with:
antosubashsimple_module_pythonrelease.ymlnpmTest plan
release.ymlwithversion=0.0.15(PyPI side already has 0.0.14 from today's failed run, so reusing the version would fail those matrix entries even withfail-fast: false).publish-npmmatrix jobs publish successfully andfinalizecommits the tag.gh secret delete NPM_TOKENand revoke the token at https://www.npmjs.com/settings/antosubash/tokens.Fallback
If only some packages publish, this is likely npm/cli#8678 (open scoped-package OIDC bug). Revert this PR, rotate
NPM_TOKENto a classic automation token (no expiry, unlike granular tokens), and the original workflow works as-is.