From 4c4189c8d6753fdbedaddd2a5484995008fcb957 Mon Sep 17 00:00:00 2001 From: CrewCircle Date: Tue, 28 Jul 2026 15:18:50 +1000 Subject: [PATCH] Prep npm publish jobs for Trusted Publishing (OIDC) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps Node to 22 and pins npm CLI >=11.5.1 in both publish jobs — npm's trusted-publishing docs (docs.npmjs.com/trusted-publishers) specify these as hard minimums for the OIDC exchange. permissions.id-token was already set at the workflow level from the original scaffolding. NPM_TOKEN stays as a fallback: npm CLI auto-detects and prefers the OIDC/id-token environment once trusted publishing is configured for a package on npmjs.com, no further workflow change needed at that point. Note: this does not remove the need to create the @crewcircle npm organization first — trusted publishing is configured per-package on npmjs.com and doesn't appear to support reserving a scope that doesn't exist yet (unclear from docs whether it works before a package's first publish at all; docs.npmjs.com/creating-an-organization is still the path to actually create the org). Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release.yml | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index aa82625..d7306df 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -91,10 +91,16 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: '20' + node-version: '22' cache: 'npm' registry-url: 'https://registry.npmjs.org' + # Trusted publishing (OIDC) requires npm CLI >=11.5.1; Node 22's bundled + # npm may be older, so pin explicitly rather than relying on whatever + # setup-node resolves. + - name: Update npm + run: npm install -g npm@^11.5.1 + - name: Install dependencies run: npm ci @@ -104,6 +110,10 @@ jobs: - name: Verify package run: npm pack --dry-run --workspace=@crewcircle/knowledge + # NPM_TOKEN is a fallback only — once trusted publishing is configured + # for this package on npmjs.com, npm CLI detects the OIDC (id-token) + # environment automatically and uses that instead, with no code change + # needed here. - name: Publish to npm run: npm publish --workspace=@crewcircle/knowledge --access public --provenance env: @@ -122,10 +132,16 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: '20' + node-version: '22' cache: 'npm' registry-url: 'https://registry.npmjs.org' + # Trusted publishing (OIDC) requires npm CLI >=11.5.1; Node 22's bundled + # npm may be older, so pin explicitly rather than relying on whatever + # setup-node resolves. + - name: Update npm + run: npm install -g npm@^11.5.1 + - name: Install dependencies run: npm ci @@ -135,6 +151,10 @@ jobs: - name: Verify package run: npm pack --dry-run --workspace=@crewcircle/docs-gen + # NPM_TOKEN is a fallback only — once trusted publishing is configured + # for this package on npmjs.com, npm CLI detects the OIDC (id-token) + # environment automatically and uses that instead, with no code change + # needed here. - name: Publish to npm run: npm publish --workspace=@crewcircle/docs-gen --access public --provenance env: