Prep npm publish jobs for Trusted Publishing (OIDC) - #31
Merged
Conversation
Bumps Node to 22 and pins npm CLI >=11.5.1 in both publish jobs — npm's trusted-publishing docs (docs.npmjs.com/trusted-publishers) specify these as hard minimums for the OIDC exchange. permissions.id-token was already set at the workflow level from the original scaffolding. NPM_TOKEN stays as a fallback: npm CLI auto-detects and prefers the OIDC/id-token environment once trusted publishing is configured for a package on npmjs.com, no further workflow change needed at that point. Note: this does not remove the need to create the @crewcircle npm organization first — trusted publishing is configured per-package on npmjs.com and doesn't appear to support reserving a scope that doesn't exist yet (unclear from docs whether it works before a package's first publish at all; docs.npmjs.com/creating-an-organization is still the path to actually create the org). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Read docs.npmjs.com/trusted-publishers directly (not from training data — this is a newer feature) and bumped both
publish-knowledgeandpublish-docs-genjobs to meet its hard requirements:npm install -g npm@^11.5.1step (Node 22's bundled npm may be older than the required ≥11.5.1; setup-node doesn't let you pin the npm CLI version separately)permissions.id-token: writewas already present at the workflow level from the original scaffolding — no change needed thereNPM_TOKENstays wired as a fallback rather than being removed: per the docs, npm CLI auto-detects and prefers the OIDC/trusted-publisher path once it's configured for a package, falling back to the token otherwise. So this PR is safe to merge now, before trusted publishing is actually set up.Important — this does NOT unblock publishing by itself
Trusted Publishing is configured per-package on npmjs.com (Settings → Trusted Publisher → GitHub Actions → org/repo/workflow filename), which requires being logged into the npm account. The docs don't clearly state whether it can be configured before a package's first publish, or whether the
@crewcirclenpm organization still needs to exist first (previous attempts at creating it weren't working — cause unconfirmed, needs another look on npmjs.com directly). This PR just makes the workflow ready for OIDC once that's sorted out.Test plan
permissions.id-token: writeconfirmed present🤖 Generated with Claude Code