Skip to content

Publish to npm via trusted publishing instead of NPM_TOKEN #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mikelittle wants to merge 1 commit into
base: main
Choose a base branch
from
+12 −12
Open

Publish to npm via trusted publishing instead of NPM_TOKEN #48

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Release

# Publishes to npm when a GitHub Release is published.
# See RELEASING.md for the full process and required NPM_TOKEN secret.
# Authenticates to npm as a trusted publisher via OIDC (no token needed).
# See RELEASING.md for the full process.
on:
release:
types: [published]
Expand All @@ -21,6 +22,10 @@ jobs:
node-version: 20
registry-url: 'https://registry.npmjs.org'

# Trusted publishing via OIDC requires npm >= 11.5.1; Node 20 ships npm 10.
- name: Upgrade npm
run: npm install -g npm@latest

- run: npm ci

- name: Verify tag matches package.json version
Expand All @@ -42,5 +47,3 @@ jobs:

- name: Publish to npm
run: npm publish --provenance --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
15 changes: 6 additions & 9 deletions RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,17 +47,14 @@ Publishing the release triggers `.github/workflows/release.yml`, which:
- runs `npm audit` (advisory — does not block the release),
- publishes to npm with [provenance](https://docs.npmjs.com/generating-provenance-statements).

## One-time setup: the `NPM_TOKEN` secret
## One-time setup: trusted publishing

Publishing needs an npm access token stored as a repository secret named
`NPM_TOKEN`:
Publishing authenticates to npm as a
[trusted publisher](https://docs.npmjs.com/trusted-publishers) via OIDC — no
token or repository secret is required.

1. On [npmjs.com](https://www.npmjs.com/) → **Access Tokens** → **Generate New
Token** → **Granular Access Token** (recommended) with **Read and write**
permission scoped to the `altis-cli` package. Use an **Automation** token so
it bypasses 2FA in CI.
2. In GitHub: **Settings → Secrets and variables → Actions → New repository
secret**, name it `NPM_TOKEN`, and paste the token.
The workflow grants `id-token: write` (for the OIDC exchange) and upgrades npm
to a version new enough to support trusted publishing.

Provenance additionally requires the repository to be public and the
`repository` field in `package.json` to be set (both already true).
Expand Down
Loading