Skip to content

fix(npm): update npm publishing to use OIDC - #1231

Merged
tdakhla merged 1 commit into
betafrom
feature/update-npm-publish-oidc
May 21, 2026
Merged

fix(npm): update npm publishing to use OIDC#1231
tdakhla merged 1 commit into
betafrom
feature/update-npm-publish-oidc

Conversation

@tdakhla

@tdakhla tdakhla commented May 21, 2026

Copy link
Copy Markdown
Contributor

No description provided.

Copilot AI review requested due to automatic review settings May 21, 2026 15:43
@tdakhla
tdakhla merged commit 526b477 into beta May 21, 2026
5 checks passed
@tdakhla
tdakhla deleted the feature/update-npm-publish-oidc branch May 21, 2026 15:46

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the release pipeline to publish the package to npm via GitHub Actions OIDC (Trusted Publishing) with provenance, instead of letting @semantic-release/npm perform the publish.

Changes:

  • Disable npm publishing inside semantic-release (@semantic-release/npm now uses npmPublish: false).
  • Enable npm provenance in package.json publish configuration.
  • Add an explicit npm publish --provenance step to the GitHub release workflow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
release.config.cjs Disables semantic-release’s built-in npm publish step while retaining npm-related prepare behavior.
package.json Enables publishConfig.provenance for npm publishes.
.github/workflows/release.yml Adds a dedicated “Trusted Publisher” npm publish step after semantic-release.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Publish to npm (Trusted Publisher)
run: npm publish --provenance --access public
Comment on lines +42 to +44
- name: Publish to npm (Trusted Publisher)
run: npm publish --provenance --access public

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants