[FSSDK-12891] Switch npm publishing to OIDC trusted publishing#345
Open
FarhanAnjum-opti wants to merge 1 commit into
Open
[FSSDK-12891] Switch npm publishing to OIDC trusted publishing#345FarhanAnjum-opti wants to merge 1 commit into
FarhanAnjum-opti wants to merge 1 commit into
Conversation
Replace long-lived PUBLISH_REACT_TO_NPM_FROM_GITHUB token with OIDC trusted publishing for more secure, tokenless CI publishing to npm. Workflow changes: - Add id-token: write permission for OIDC token generation - Move permissions to workflow level (add packages: write for GHR) - Add GitHub environment gate (npm) for deployment protection - Upgrade Node to 22, add npm upgrade step (OIDC requires npm 11.5.1+) - Remove registry-url from setup-node (prevents .npmrc token entry that would conflict with OIDC) - Remove PUBLISH_REACT_TO_NPM_FROM_GITHUB from npm publish step - Add workflow_dispatch trigger for dry-run testing - Add DRY_RUN env to both publish steps publish.sh changes: - Make NODE_AUTH_TOKEN optional in curl registry lookup (public packages don't need auth for reads) - Add --provenance flag for npm registry publishes GHR publish step unchanged — still uses GITHUB_TOKEN. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PUBLISH_REACT_TO_NPM_FROM_GITHUBtoken with OIDC trusted publishing for tokenless, more secure CI publishing to npmregistry-urlfromsetup-nodeto prevent.npmrctoken entry that conflicts with OIDC--provenanceflag for supply-chain attestationsnpmenvironment gate for deployment protectionworkflow_dispatchtrigger for dry-run testingPrerequisites
@optimizely/react-sdk(owner:optimizely, repo:react-sdk, workflow:react_release.yml, environment:npm)npmwith required reviewers and branch restrictionsTest plan
npmGitHub environmentworkflow_dispatchon this branch to verify OIDC handshake (dry run)PUBLISH_REACT_TO_NPM_FROM_GITHUBsecretReferences
🤖 Generated with Claude Code