ci: publish to npm via Trusted Publishing (OIDC), drop NPM_TOKEN#127
Merged
Conversation
release-please.yml published with a long-lived NODE_AUTH_TOKEN/NPM_TOKEN that kept failing (claudius-chat-widget stuck at 1.6.0; create-claudius never published). Switch the automatic release publish to npm Trusted Publishing (OIDC): remove NODE_AUTH_TOKEN, upgrade to npm >= 11.5.1, bump publish Node to 22, and rely on the existing id-token: write permission. Each package needs a trusted publisher (repo + release-please.yml) configured at npmjs.com. Also correct publish-npm.yml's comment: OIDC cannot do a new package's first publish (npm requires the package to exist before a trusted publisher can be configured), and only one trusted publisher is allowed per package. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deploying chat-widget with
|
| Latest commit: |
95e350d
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://5315cffa.chat-widget-ejc.pages.dev |
| Branch Preview URL: | https://ci-npm-trusted-publishing.chat-widget-ejc.pages.dev |
PAMulligan
added
bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm publishing has been failing since 1.6.0 —
release-please.ymlpublished with a long-livedNPM_TOKENthat can no longer create/publish these packages (claudius-chat-widgetis stuck at 1.6.0;create-claudiushas never published). This switches the automatic release publish to npm Trusted Publishing (OIDC) and removes the long-lived token.Changes
release-please.yml: dropNODE_AUTH_TOKENfrom both publish steps; addnpm install -g npm@latest(Trusted Publishing needs npm ≥ 11.5.1); bump publish Node to 22. Keepsid-token: write,registry-url, and--provenance(provenance is automatic with OIDC).publish-npm.yml: correct the comment — OIDC can't do a brand-new package's first publish (npm requires the package to exist before a trusted publisher can be configured), and npm allows only one trusted publisher per package (configured forrelease-please.yml). Node 22 for consistency.create-claudiusdoesn't exist yet and OIDC can't do a first publish, do one token-based publish ofclaudius-chat-widget@1.8.0andcreate-claudius@1.8.0(locally, with a temporary granular All packages, read+write, bypass-2FA token).PMDevSolutions, repositoryClaudius, workflow filenamerelease-please.yml, environment blank, allowed actionnpm publish.NPM_TOKENrepo secret is no longer referenced and can be removed:gh secret delete NPM_TOKEN --repo PMDevSolutions/Claudius. Delete the temporary npm token as well.Why a token is still needed once
Per npm's docs, a package must exist before a trusted publisher can be configured, so the first publish of a new package must use a token — there's no OIDC path for it. After
create-claudiusexists, all future releases of both packages publish via OIDC with no stored secret.Refs: npm Trusted Publishing docs, GA announcement.
🤖 Generated with Claude Code