From 894a93efcb4ab4009391d32271f3469f02b53d79 Mon Sep 17 00:00:00 2001 From: Yash Chauhan Date: Sat, 17 Oct 2026 18:41:55 +0530 Subject: [PATCH] ci: let the first npm release publish with an NPM_TOKEN secret npm only lets a trusted publisher be attached to an existing package, so the first release needs a token. When the NPM_TOKEN secret is set the release publishes with it; otherwise it uses Trusted Publishing as before. --- .github/workflows/release.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9bf4614..a041f99 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,6 +7,9 @@ on: push: tags: ["v*"] +env: + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + permissions: contents: read id-token: write # OIDC token for npm Trusted Publishing @@ -36,4 +39,14 @@ jobs: - run: pnpm build # Trusted Publishing needs npm 11.5.1 or later; Node 22 ships npm 10. - run: npm install -g npm@11.5.1 - - run: npm publish --access public + # Bootstrap: npm only lets a trusted publisher be attached to a package that already + # exists, so the first release can use an NPM_TOKEN secret (a granular token for the + # @flamai scope). Delete the secret once the trusted publisher is set up. + - name: Publish with NPM_TOKEN + if: env.NPM_TOKEN != '' + run: npm publish --access public + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + - name: Publish with Trusted Publishing + if: env.NPM_TOKEN == '' + run: npm publish --access public