Migrate NPM publishing to OIDC trusted publishing#3949
Conversation
Switch from classic NPM token auth to OIDC trusted publishing: - Add id-token: write permission for OIDC - Upgrade to actions/setup-node@v4 with Node 24 and registry-url - Replace yarn publish with npm publish --provenance - Remove YARN_NPM_AUTH_TOKEN secret dependency Trusted Publisher has been configured on npmjs.com for all 117 @datadog/datadog-api-client* packages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
|
||
| permissions: | ||
| contents: write | ||
| id-token: write # Required for OIDC trusted publishing |
There was a problem hiding this comment.
Without this, GitHub Actions can't generate the OIDC token that npm needs
| with: | ||
| fetch-depth: 1 | ||
| - uses: actions/setup-node@v3 | ||
| - uses: actions/setup-node@v4 |
There was a problem hiding this comment.
GitHub will force Node 24 in June 2026 so I took the opportunity to bump the version
| cd $(echo $tag_name | rev | cut -d'/' -f2- | rev) | ||
| fi | ||
|
|
||
| yarn_major_version=$(yarn --version | cut -d'.' -f1) |
There was a problem hiding this comment.
npm publish is the only officially supported path for OIDC trusted publishing.
Kaycell
changed the title
|
/merge |
|
View all feedbacks in Devflow UI.
This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
kevin.viricel@datadoghq.com unqueued this merge request |
|
/remove |
|
View all feedbacks in Devflow UI.
|
gh-worker-dd-devflow-36fce6
bot
added
mergequeue-status: removed
and removed
mergequeue-status: waiting
labels
Switch from classic NPM token auth to OIDC trusted publishing: - Add id-token: write permission for OIDC - Upgrade to actions/setup-node@v4 with Node 24 and registry-url - Replace yarn publish with npm publish --provenance - Remove YARN_NPM_AUTH_TOKEN secret dependency Trusted Publisher has been configured on npmjs.com for all 117 @datadog/datadog-api-client* packages. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> db9f656
2 participants
Summary
YARN_NPM_AUTH_TOKEN) to OIDC trusted publishingactions/setup-node@v4with Node 24 (required for OIDC)yarn publishwithnpm publish --provenancefor provenance attestationContext
Classic NPM tokens were revoked, breaking all publishes since April 1 (v1.54.0 + 29 sub-package releases). Trusted Publisher has been configured on npmjs.com for all 117
@datadog/datadog-api-client*packages.Test plan
generators: typescript_split_package,typescript_legacy_package🤖 Generated with Claude Code