From 41744cce83ae77dd5ceb6d4de02275d558e3b0b9 Mon Sep 17 00:00:00 2001 From: Minsu Lee Date: Wed, 14 Oct 2026 18:38:30 +0900 Subject: [PATCH] ci(release): publish to npm through OIDC trusted publishing only Drop the actions/setup-node step from the publish job. It only wrote an .npmrc that reads NODE_AUTH_TOKEN, which nothing sets, so npm saw a placeholder token next to the OIDC exchange. npm now authenticates with id-token: write and each package's trusted publisher alone, and a package without one fails instead of falling back to a token. --- .github/workflows/release-please.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index b943fe3..b29ce45 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -109,13 +109,12 @@ jobs: - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 # npm CLI is the publisher: bun publish supports neither npm OIDC - # trusted publishing nor --provenance (oven-sh/bun#22423). setup-node - # only provisions the registry .npmrc here (no node-version: it uses the - # mise-installed node on PATH); id-token: write + a trusted publisher - # configured on npmjs.com let npm authenticate tokenlessly via OIDC. - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - registry-url: https://registry.npmjs.org + # trusted publishing nor --provenance (oven-sh/bun#22423). Publishing + # authenticates through OIDC only: id-token: write plus a trusted + # publisher configured on npmjs.com for each package. No .npmrc auth + # token is provisioned (no setup-node registry-url / NODE_AUTH_TOKEN), so + # a package without a trusted publisher fails to publish rather than + # falling back to a token. # OIDC trusted publishing requires npm >= 11.5.1; pin to the latest 11.x # in case the runner's bundled npm predates it.