feat: use trusted publishers instead of access tokens

Author: cjlyons

.github/workflows/cd.yml

@@ -116,6 +116,9 @@ jobs:
     needs: validate
     if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish-prerelease == 'true'
     environment: prerelease
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout code
@@ -138,7 +141,7 @@ jobs:
       - name: Install Python build tools
         run: |
           python -m pip install --upgrade pip
-          pip install build twine
+          pip install build
 
       - name: Get version and create pre-release tag
         id: version
@@ -163,16 +166,12 @@ jobs:
 
       - name: Publish TypeScript to npm (next tag)
         working-directory: packages/flarelette-jwt-ts
-        run: npm publish --tag next --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --provenance --tag next --access public
 
       - name: Publish Python to PyPI (with pre-release classifier)
-        working-directory: packages/flarelette-jwt-py
-        run: python -m twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: packages/flarelette-jwt-py/dist/
 
       - name: Summary
         run: |

.github/workflows/manual-publish.yml

@@ -23,6 +23,9 @@ jobs:
   publish-npm:
     runs-on: ubuntu-latest
     if: ${{ github.event.inputs.package == 'typescript' || github.event.inputs.package == 'both' }}
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout code
@@ -44,13 +47,14 @@ jobs:
 
       - name: Publish to npm
         working-directory: packages/flarelette-jwt-ts
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --provenance --access public
 
   publish-pypi:
     runs-on: ubuntu-latest
     if: ${{ github.event.inputs.package == 'python' || github.event.inputs.package == 'both' }}
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout code
@@ -66,7 +70,7 @@ jobs:
       - name: Install build tools
         run: |
           python -m pip install --upgrade pip
-          pip install build twine
+          pip install build
 
       - name: Build Python package
         working-directory: packages/flarelette-jwt-py
@@ -75,8 +79,6 @@ jobs:
           python -m build
 
       - name: Publish to PyPI
-        working-directory: packages/flarelette-jwt-py
-        run: python -m twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: packages/flarelette-jwt-py/dist/

.github/workflows/release.yml

@@ -31,6 +31,9 @@ jobs:
     needs: release-please
     runs-on: ubuntu-latest
     if: ${{ needs.release-please.outputs.ts_release_created }}
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout code
@@ -50,14 +53,15 @@ jobs:
 
       - name: Publish to npm
         working-directory: packages/flarelette-jwt-ts
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --provenance --access public
 
   publish-pypi:
     needs: release-please
     runs-on: ubuntu-latest
     if: ${{ needs.release-please.outputs.py_release_created }}
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout code
@@ -71,7 +75,7 @@ jobs:
       - name: Install build tools
         run: |
           python -m pip install --upgrade pip
-          pip install build twine
+          pip install build
 
       - name: Build Python package
         working-directory: packages/flarelette-jwt-py
@@ -80,8 +84,6 @@ jobs:
           python -m build
 
       - name: Publish to PyPI
-        working-directory: packages/flarelette-jwt-py
-        run: python -m twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: packages/flarelette-jwt-py/dist/

CONTRIBUTING.md

@@ -288,7 +288,7 @@ The project uses automated releases via [release-please](https://github.com/goog
 
 See **[RELEASING.md](RELEASING.md)** for detailed release process and **[RELEASE_CHECKLIST.md](RELEASE_CHECKLIST.md)** for setup.
 
-**For maintainers:** Ensure `NPM_TOKEN` and `PYPI_TOKEN` secrets are configured in repository settings.
+**For maintainers:** Configure npm and PyPI trusted publishing for this repository/workflow (GitHub OIDC). `NPM_TOKEN` and `PYPI_TOKEN` secrets are not required.
 
 ## Questions?
 

packages/CONTRIBUTING.md

@@ -288,7 +288,7 @@ The project uses automated releases via [release-please](https://github.com/goog
 
 See **[RELEASING.md](RELEASING.md)** for detailed release process and **[RELEASE_CHECKLIST.md](RELEASE_CHECKLIST.md)** for setup.
 
-**For maintainers:** Ensure `NPM_TOKEN` and `PYPI_TOKEN` secrets are configured in repository settings.
+**For maintainers:** Configure npm and PyPI trusted publishing for this repository/workflow (GitHub OIDC). `NPM_TOKEN` and `PYPI_TOKEN` secrets are not required.
 
 ## Questions?