Skip to content

ci: npm trusted publishing (OIDC), no NPM_TOKEN - #65

Open
thorwhalen wants to merge 1 commit into
mainfrom
ci/npm-trusted-publishing
Open

thorwhalen wants to merge 1 commit into
mainfrom
ci/npm-trusted-publishing

Conversation

@thorwhalen

Copy link
Copy Markdown
Member

Switches npm publishing to trusted publishing (OIDC) only: job gets id-token: write, Node 24, npm >= 11.5.1 ensured, NPM_TOKEN / NODE_AUTH_TOKEN removed, --provenance on. Also upgrades changesets/action v1 -> v2 (v1 wrote a token .npmrc from NPM_TOKEN; v2 supports trusted publishing) and renames its inputs/outputs accordingly. PyPI job untouched. Not merged: acture-forms-rjsf is 1.1.0 locally vs 1.0.0 on npm, so merging to main would publish it.

Owner: add Trusted Publisher on npmjs.com for all 21 published packages (acture, acture-*, eslint-plugin-acture-migration): repo i2mint/acture, workflow release.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant