From c7db6dedce5cd504e640ee5865ce009940298c56 Mon Sep 17 00:00:00 2001 From: Snailedlt Date: Sun, 25 Oct 2026 16:13:39 +0100 Subject: [PATCH 1/2] ci: publish to npm with trusted publishing (OIDC) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/npm_publish.yml | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/.github/workflows/npm_publish.yml b/.github/workflows/npm_publish.yml index 003f98c1b..7573acde1 100644 --- a/.github/workflows/npm_publish.yml +++ b/.github/workflows/npm_publish.yml @@ -2,22 +2,31 @@ name: "Publish to npm" on: release: types: [released] + # Allows re-running a failed publish by hand from the Actions tab + workflow_dispatch: +permissions: {} jobs: publish: environment: release runs-on: ubuntu-latest + permissions: + id-token: write # Required for npm trusted publishing (OIDC) + contents: read steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # "ref" specifies the branch to check out. # "github.event.release.target_commitish" is a global variable and specifies the branch the release targeted + # It's empty on manual runs, so the branch selected in the Actions tab is used instead ref: ${{ github.event.release.target_commitish }} - - name: Use Node.js v16 - uses: actions/setup-node@v4 + persist-credentials: false + # Node 24 ships with npm 11.5.1 or later, which trusted publishing requires + - name: Use Node.js v24 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - registry-url: https://registry.npmjs.org/ # Specifies the registry, this field is required! - - run: npm ci + package-manager-cache: false + # No dependencies are installed: the package has no build step, and skipping + # them keeps third-party install scripts out of the job that can publish. + # Authenticates through the trusted publisher configured on npmjs.com, so no token is needed - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }} From b2c430a167bea95a39cf40c68bbb8df9fa42b001 Mon Sep 17 00:00:00 2001 From: Snailedlt Date: Sun, 25 Oct 2026 16:46:43 +0100 Subject: [PATCH 2/2] ci: check out release tag and use action version tags Co-authored-by: Yashh56 <141008488+Yashh56@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 --- .github/workflows/npm_publish.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/npm_publish.yml b/.github/workflows/npm_publish.yml index 7573acde1..8e8d1f0a7 100644 --- a/.github/workflows/npm_publish.yml +++ b/.github/workflows/npm_publish.yml @@ -13,16 +13,15 @@ jobs: id-token: write # Required for npm trusted publishing (OIDC) contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: - # "ref" specifies the branch to check out. - # "github.event.release.target_commitish" is a global variable and specifies the branch the release targeted - # It's empty on manual runs, so the branch selected in the Actions tab is used instead - ref: ${{ github.event.release.target_commitish }} + # Check out the release tag for release events. + # For manual runs, use the branch or tag selected in the Actions tab. + ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }} persist-credentials: false # Node 24 ships with npm 11.5.1 or later, which trusted publishing requires - name: Use Node.js v24 - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + uses: actions/setup-node@v7 with: node-version: 24 package-manager-cache: false