From 55187199693a20c87fe5238b24346681ced35fae Mon Sep 17 00:00:00 2001 From: rom1504 Date: Sat, 28 Mar 2026 16:55:23 +0000 Subject: [PATCH] Switch to trusted publishing via OIDC - Add id-token: write permission for OIDC trusted publishing - Use Node 24 (ships npm 11.11.0, trusted publishing requires >=11.5.1) - Add registry-url for OIDC auth flow - Upgrade JS-DevTools/npm-publish from v1 to v4 - Remove NPM_AUTH_TOKEN (no longer needed) Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/publish.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 95e11fb..0ae88ae 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3,6 +3,9 @@ on: push: branches: - master # Change this to your default branch +permissions: + id-token: write + contents: write jobs: npm-publish: name: npm-publish @@ -13,11 +16,10 @@ jobs: - name: Set up Node.js uses: actions/setup-node@master with: - node-version: 22.0.0 + node-version: 24 + registry-url: 'https://registry.npmjs.org' - id: publish - uses: JS-DevTools/npm-publish@v1 - with: - token: ${{ secrets.NPM_AUTH_TOKEN }} + uses: JS-DevTools/npm-publish@v4 - name: Create Release if: steps.publish.outputs.type != 'none' id: create_release