Skip to content

CHANGE @W-24708955@ Migrate npm publishing to Trusted Publishing (OIDC) #514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
nikhil-mittal-165 wants to merge 4 commits into
base: dev
Choose a base branch
from
Draft

CHANGE @W-24708955@ Migrate npm publishing to Trusted Publishing (OIDC) #514

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f36bfcf
CHANGE @W-00000000@ Migrate npm publishing to Trusted Publishing (OIDC)
nikhil-mittal-165 Oct 29, 2026
67a5e56
CHANGE @W-00000000@ Pin npm to 11 for Trusted Publishing
nikhil-mittal-165 Oct 29, 2026
2926c97
CHANGE @W-24708955@ Retrigger PR checks with work item
nikhil-mittal-165 Oct 29, 2026
e697718
CHANGE Print and enforce minimum npm version in publish workflow
nikhil-mittal-165 Nov 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions .github/workflows/publish-package-to-npm.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,6 +172,10 @@ jobs:
build-and-test-and-publish:
runs-on: ubuntu-latest
needs: [validate-packages-as-releasable, prepare-release-branch]
permissions:
# Required for npm Trusted Publishing (OIDC).
id-token: write
contents: read
steps:
- name: Support long paths
run: git config --global core.longpaths true
Expand All @@ -180,7 +184,21 @@ jobs:
ref: ${{ needs.prepare-release-branch.outputs.branch-name }}
- uses: actions/setup-node@v4
with:
node-version: 20
# Trusted Publishing requires Node >= 22.14.0.
node-version: 22
# Trusted Publishing requires npm >= 11.5.1, and managing dist-tags via OIDC requires npm >= 11.21.0.
# Pinned to the npm 11 line to stay consistent with the code-analyzer repo (npm 12 removed shrinkwrap support).
- name: Upgrade npm for Trusted Publishing
run: |
npm install -g npm@11
# Print the resolved version, and fail fast if the moving 'npm@11' tag ever resolves below what
# dist-tag management via OIDC needs, rather than failing later in the middle of a release.
NPM_VERSION="$(npm --version)"
echo "Using npm ${NPM_VERSION}"
if [ "$(printf '%s\n' "11.21.0" "${NPM_VERSION}" | sort -V | head -n1)" != "11.21.0" ]; then
echo "::error::npm ${NPM_VERSION} is older than the required 11.21.0"
exit 1
fi
- name: Build and test and publish packages
run: |
PACKAGES_TO_PUBLISH=(${{ needs.validate-packages-as-releasable.outputs.packages-to-release }})
Expand All @@ -191,8 +209,8 @@ jobs:
npm install
npm run build
npm run test
# We need the NPM token to publish.
echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
# No NPM token is needed. npm authenticates via Trusted Publishing (OIDC). Each package must have this
# workflow configured as a trusted publisher on npmjs.com, with "Allow npm dist-tag" enabled.
PUBLISHED_VERSION=$(jq -r ".version" package.json)
if [[ "${{ inputs.dryrun }}" == "true" ]]; then
npm publish --tag latest-beta --access public --verbose --dry-run
Expand Down
Loading