feat: ian/stainless_yml

Author: stainless-app[bot]

.github/workflows/publish-npm.yml

@@ -12,6 +12,9 @@ jobs:
   publish:
     name: publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@v6
@@ -31,5 +34,3 @@ jobs:
       - name: Publish to NPM
         run: |
           bash ./bin/publish-npm
-        env:
-          NPM_TOKEN: ${{ secrets.OZ_API_NPM_TOKEN || secrets.NPM_TOKEN }}

.github/workflows/release-doctor.yml

@@ -17,6 +17,4 @@ jobs:
       - name: Check release environment
         run: |
           bash ./bin/check-release-environment
-        env:
-          NPM_TOKEN: ${{ secrets.OZ_API_NPM_TOKEN || secrets.NPM_TOKEN }}
 

.gitignore

@@ -9,4 +9,4 @@ dist-deno
 /*.tgz
 .idea/
 .eslintcache
-
+oidc

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 14
 openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/warp-bnavetta%2Fwarp-api-a29592b2ba26cba9d89b95969d66506f49c08e140b76ce4aea4189e5c1dccc06.yml
 openapi_spec_hash: 27a5de1f891104d5e47904ad8e4b4bd1
-config_hash: 40327fb76b7cce7b97f23de9b8d48efb
+config_hash: 60052b2c1c0862014416821aba875574

bin/check-release-environment

@@ -2,10 +2,6 @@
 
 errors=()
 
-if [ -z "${NPM_TOKEN}" ]; then
-  errors+=("The NPM_TOKEN secret has not been set. Please set it in either this repository's secrets or your organization secrets")
-fi
-
 lenErrors=${#errors[@]}
 
 if [[ lenErrors -gt 0 ]]; then

bin/publish-npm

@@ -2,7 +2,12 @@
 
 set -eux
 
-npm config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
+if [[ ${NPM_TOKEN:-} ]]; then
+  npm config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
+elif [[ ! ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-} ]]; then
+  echo "ERROR: NPM_TOKEN must be set if not running in a Github Action with id-token permission"
+  exit 1
+fi
 
 pnpm build
 cd dist
@@ -57,5 +62,8 @@ else
   TAG="latest"
 fi
 
+# Install OIDC compatible npm version
+npm install --prefix ../oidc/ npm@11.6.2
+
 # Publish with the appropriate tag
-pnpm publish --no-git-checks --tag "$TAG"
+pnpm publish --npm-path "$(cd ../ && pwd)/oidc/node_modules/.bin/npm" --no-git-checks --tag "$TAG"