ci: publish to npm via OIDC trusted publishing#124
Merged
Conversation
Switch the manual npm publish workflow from a long-lived NPM_TOKEN secret to npm Trusted Publishing: - Remove NODE_AUTH_TOKEN from the publish step so npm authenticates via the GitHub Actions OIDC token (id-token: write is already granted) against the trusted publisher configured on each package at npmjs.com. - Upgrade the runner's npm to latest before publishing; Trusted Publishing needs npm >= 11.5.1 and Node 20 ships npm 10.x. - Update the header comment to document the new auth model. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
actions/setup-node with registry-url writes an .npmrc containing a placeholder _authToken (XXXXX-XXXXX-XXXXX-XXXXX). npm sees a configured token and attempts token auth with that garbage value instead of performing the OIDC trusted-publishing exchange, producing a 404 on publish. Removing registry-url leaves no auth token configured, so npm falls through to OIDC. The default registry is already registry.npmjs.org. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reverts the registry-url removal. The npm docs confirm registry-url is required for trusted publishing: it points npm at the registry to mint the OIDC token against. Without it npm performs no OIDC exchange and fails with ENEEDAUTH. The placeholder _authToken setup-node writes is ignored by npm in favour of OIDC whenever a matching trusted publisher exists for the package. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Switches the manual
publish-npm.ymlworkflow from a long-livedNPM_TOKENsecret to npm Trusted Publishing (OIDC).
NODE_AUTH_TOKENfrom the publish step so npm authenticates via theGitHub Actions OIDC token against the trusted publisher configured on the
package at npmjs.com — no stored secret.
npm install -g npm@lateststep: trusted publishing needs npm≥ 11.5.1 and Node 20 ships npm 10.x.
registry-urlinsetup-node(required — it points npm at theregistry to mint the OIDC token against; the placeholder
_authTokenitwrites is ignored by npm in favour of OIDC when a matching trusted publisher
exists).
Why
The token-based publish was failing with
E404onPUT .../claudius-chat-widget.The token, account, and permissions all checked out (
pmds, read+write allpackages), so the long-lived-secret path was both fragile and the source of the
failure. Trusted Publishing removes the secret entirely and is npm's
recommended path for CI.
Status
The workflow change is complete and the OIDC path is wired correctly (verified
by the error progressing from
E404→ENEEDAUTH→ OIDC engaged onceregistry-urlwas restored). A successful publish additionally requires thenpm Trusted Publisher config to match this repo exactly (case-sensitive):
PMDevSolutions/Claudius/publish-npm.yml, withnpm publishallowed.That match is being verified before the first green run.
Related to #41.
🤖 Generated with Claude Code