From 4f0ed5e04a35083cfffb252a165f9e5495276a14 Mon Sep 17 00:00:00 2001 From: Ryan Yannelli Date: Mon, 5 Oct 2026 04:31:41 +0000 Subject: [PATCH] ci(release): publish to npm through trusted publishing only --- .github/workflows/release.yml | 2 -- README.md | 2 +- docs/INDEX.md | 2 +- docs/npm-publishing.md | 9 +++++---- 4 files changed, 7 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8009246..36908fd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,5 +56,3 @@ jobs: else npm publish fi - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/README.md b/README.md index 629b066..8640393 100644 --- a/README.md +++ b/README.md @@ -114,7 +114,7 @@ See the [documentation index](docs/INDEX.md) for the current composer button con ## Releases -GitHub Actions runs the checks and publishes a GitHub release on qualifying pushes to `main`. The first release is `v0.1.0`. The workflow updates `package.json` and `package-lock.json`, pushes an annotated tag, and publishes release notes with the repository's `GITHUB_TOKEN`. It then publishes [`@yannelli/paseo-be-concise`](https://www.npmjs.com/package/@yannelli/paseo-be-concise) to npm through trusted publishing, or with the `NPM_TOKEN` secret when no trusted publisher is set. See [npm publishing](docs/npm-publishing.md) for the package contents and the trusted publisher setup. +GitHub Actions runs the checks and publishes a GitHub release on qualifying pushes to `main`. The first release is `v0.1.0`. The workflow updates `package.json` and `package-lock.json`, pushes an annotated tag, and publishes release notes with the repository's `GITHUB_TOKEN`. It then publishes [`@yannelli/paseo-be-concise`](https://www.npmjs.com/package/@yannelli/paseo-be-concise) to npm through trusted publishing (OIDC), with no npm token. See [npm publishing](docs/npm-publishing.md) for the package contents and the trusted publisher setup. Use Conventional Commits in commits and squash-merge titles: diff --git a/docs/INDEX.md b/docs/INDEX.md index 05c13f4..d6fa14e 100644 --- a/docs/INDEX.md +++ b/docs/INDEX.md @@ -4,4 +4,4 @@ Created: 2026-10-04. Last updated: 2026-10-05. - [Composer pill and screenshots](composer-pill.md): compact status labels, the Paseo button contract, and screenshot capture details. Read this before changing labels or refreshing images. - [be-concise installer](plugin-installer.md): GitHub release handling, the Claude Code and Codex CLI commands, storage, and adapter discovery order. Read this before you change the Plugin tab or install commands. -- [npm publishing](npm-publishing.md): the npm package contents, the release workflow publish step, the `NPM_TOKEN` secret, and the trusted publisher setup. Read this before you change `files` in `package.json` or the release authentication. +- [npm publishing](npm-publishing.md): the npm package contents, the release workflow publish step, and the trusted publisher setup. Read this before you change `files` in `package.json` or the release authentication. diff --git a/docs/npm-publishing.md b/docs/npm-publishing.md index 212acc7..150bd71 100644 --- a/docs/npm-publishing.md +++ b/docs/npm-publishing.md @@ -18,14 +18,15 @@ The **Publish npm package** step reads the name and version from `package.json`. ## Authentication -npm CLI 11.5.1 or newer on Node.js 22.14.0 or newer tries [trusted publishing](https://docs.npmjs.com/trusted-publishers) (OIDC) first. Without a trusted publisher on the package, it uses `NODE_AUTH_TOKEN`, which the step reads from the `NPM_TOKEN` repository secret. The current token is a granular token scoped to `@yannelli` that bypasses 2FA and expires on 2027-01-03. [From January 2027](https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens/), npm blocks direct publish with 2FA-bypass tokens, so token-based releases stop then. Set up the trusted publisher before that date. +The package has a [trusted publisher](https://docs.npmjs.com/trusted-publishers) for `release.yml` in `yannelli/paseo-plugin-concise`, added on 2026-10-05. npm CLI 11.5.1 or newer on Node.js 22.14.0 or newer exchanges the job's OIDC token for a short-lived publish token. The workflow reads no npm secret. -`npm trust` rejects tokens that bypass 2FA, and the package must exist on npm. To add the trusted publisher, sign in with 2FA and run: +The trust entry names the workflow file. When you rename `release.yml` or move the publish step to another workflow, replace the entry. `npm trust` requires a 2FA login and rejects tokens that bypass 2FA: ```sh npm login -npm trust github @yannelli/paseo-be-concise --repo yannelli/paseo-plugin-concise --file release.yml --allow-publish npm trust list @yannelli/paseo-be-concise +npm trust revoke @yannelli/paseo-be-concise --id= +npm trust github @yannelli/paseo-be-concise --repo yannelli/paseo-plugin-concise --file .yml --allow-publish ``` -Or open the package on npmjs.com, then **Settings → Trusted publishing**, and add GitHub Actions, with owner `yannelli`, repository `paseo-plugin-concise`, and workflow `release.yml`. After the next release publishes through OIDC, delete the `NPM_TOKEN` secret and set **Publishing access** to require 2FA and disallow tokens. +The npmjs.com equivalent is the package's **Settings → Trusted publishing**. Set **Publishing access** to require 2FA and disallow tokens, because the workflow publishes without a token.