From f36bfcfafd783fe382ae5c0d16bbab8f1941057a Mon Sep 17 00:00:00 2001 From: nikhil-mittal-165 Date: Thu, 29 Oct 2026 12:34:39 +0530 Subject: [PATCH 1/4] CHANGE @W-00000000@ Migrate npm publishing to Trusted Publishing (OIDC) Replace the long-lived NPM_TOKEN with npm Trusted Publishing, ahead of npm's bypass-2fa publish deprecation. - Grant id-token: write on the publish job - Move the publish job to Node 22 and upgrade npm (Trusted Publishing needs Node >= 22.14.0 and npm >= 11.5.1; OIDC dist-tag needs npm >= 11.21.0) - Drop the NPM_TOKEN .npmrc write Requires each published package to have this workflow configured as a trusted publisher on npmjs.com (with "Allow npm dist-tag" enabled) before merging. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/publish-package-to-npm.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish-package-to-npm.yml b/.github/workflows/publish-package-to-npm.yml index 40698451..2e2be834 100644 --- a/.github/workflows/publish-package-to-npm.yml +++ b/.github/workflows/publish-package-to-npm.yml @@ -172,6 +172,10 @@ jobs: build-and-test-and-publish: runs-on: ubuntu-latest needs: [validate-packages-as-releasable, prepare-release-branch] + permissions: + # Required for npm Trusted Publishing (OIDC). + id-token: write + contents: read steps: - name: Support long paths run: git config --global core.longpaths true @@ -180,7 +184,11 @@ jobs: ref: ${{ needs.prepare-release-branch.outputs.branch-name }} - uses: actions/setup-node@v4 with: - node-version: 20 + # Trusted Publishing requires Node >= 22.14.0. + node-version: 22 + # Trusted Publishing requires npm >= 11.5.1, and managing dist-tags via OIDC requires npm >= 11.21.0. + - name: Upgrade npm for Trusted Publishing + run: npm install -g npm@latest - name: Build and test and publish packages run: | PACKAGES_TO_PUBLISH=(${{ needs.validate-packages-as-releasable.outputs.packages-to-release }}) @@ -191,8 +199,8 @@ jobs: npm install npm run build npm run test - # We need the NPM token to publish. - echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc + # No NPM token is needed. npm authenticates via Trusted Publishing (OIDC). Each package must have this + # workflow configured as a trusted publisher on npmjs.com, with "Allow npm dist-tag" enabled. PUBLISHED_VERSION=$(jq -r ".version" package.json) if [[ "${{ inputs.dryrun }}" == "true" ]]; then npm publish --tag latest-beta --access public --verbose --dry-run From 67a5e569d5b2e1322df12d5095d2848f38f257f1 Mon Sep 17 00:00:00 2001 From: nikhil-mittal-165 Date: Thu, 29 Oct 2026 13:14:11 +0530 Subject: [PATCH 2/4] CHANGE @W-00000000@ Pin npm to 11 for Trusted Publishing Install npm@11 (>= 11.21.0 has OIDC dist-tag support) instead of latest, to stay consistent with the code-analyzer repo, which must stay on npm 11 because npm 12 removed shrinkwrap support. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/publish-package-to-npm.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-package-to-npm.yml b/.github/workflows/publish-package-to-npm.yml index 2e2be834..f1a1072e 100644 --- a/.github/workflows/publish-package-to-npm.yml +++ b/.github/workflows/publish-package-to-npm.yml @@ -187,8 +187,9 @@ jobs: # Trusted Publishing requires Node >= 22.14.0. node-version: 22 # Trusted Publishing requires npm >= 11.5.1, and managing dist-tags via OIDC requires npm >= 11.21.0. + # Pinned to the npm 11 line to stay consistent with the code-analyzer repo (npm 12 removed shrinkwrap support). - name: Upgrade npm for Trusted Publishing - run: npm install -g npm@latest + run: npm install -g npm@11 - name: Build and test and publish packages run: | PACKAGES_TO_PUBLISH=(${{ needs.validate-packages-as-releasable.outputs.packages-to-release }}) From 2926c973761224a9e3e3d4f9d1f84b849ea24685 Mon Sep 17 00:00:00 2001 From: nikhil-mittal-165 Date: Thu, 29 Oct 2026 14:02:38 +0530 Subject: [PATCH 3/4] CHANGE @W-24708955@ Retrigger PR checks with work item Co-Authored-By: Claude Opus 5.5 (1M context) From e697718b7514a2f915ceac7f488c9d6fff46416d Mon Sep 17 00:00:00 2001 From: nikhil-mittal-165 Date: Tue, 3 Nov 2026 11:44:26 +0530 Subject: [PATCH 4/4] CHANGE Print and enforce minimum npm version in publish workflow The workflow installs the moving npm@11 tag. Print the resolved version and fail fast if it is older than 11.21.0 (needed for dist-tag management via OIDC) instead of failing mid-release. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/publish-package-to-npm.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-package-to-npm.yml b/.github/workflows/publish-package-to-npm.yml index f1a1072e..fdf5cd16 100644 --- a/.github/workflows/publish-package-to-npm.yml +++ b/.github/workflows/publish-package-to-npm.yml @@ -189,7 +189,16 @@ jobs: # Trusted Publishing requires npm >= 11.5.1, and managing dist-tags via OIDC requires npm >= 11.21.0. # Pinned to the npm 11 line to stay consistent with the code-analyzer repo (npm 12 removed shrinkwrap support). - name: Upgrade npm for Trusted Publishing - run: npm install -g npm@11 + run: | + npm install -g npm@11 + # Print the resolved version, and fail fast if the moving 'npm@11' tag ever resolves below what + # dist-tag management via OIDC needs, rather than failing later in the middle of a release. + NPM_VERSION="$(npm --version)" + echo "Using npm ${NPM_VERSION}" + if [ "$(printf '%s\n' "11.21.0" "${NPM_VERSION}" | sort -V | head -n1)" != "11.21.0" ]; then + echo "::error::npm ${NPM_VERSION} is older than the required 11.21.0" + exit 1 + fi - name: Build and test and publish packages run: | PACKAGES_TO_PUBLISH=(${{ needs.validate-packages-as-releasable.outputs.packages-to-release }})