ci: publish to npm by trusted publishing instead of a stored token - #305
Merged
Conversation
Removes the NPM_TOKEN requirement. npm now trades the short-lived OIDC token GitHub mints for this specific workflow run for permission to publish, so there is no long-lived credential in the repository to leak, rotate or forget — and none had to be minted, since the secret was never added. Two things that would have failed quietly otherwise: Node 22 bundles npm 10, which predates trusted publishing and falls back to looking for a token that no longer exists — an auth failure that reads as a credential problem rather than a version one. So npm is upgraded first, and the 11.5.1 floor is checked rather than assumed. The check compares with `sort -V`: lexically, 11.16.0 is lower than 11.5.1. `--provenance` is gone because trusted publishing generates and attaches the attestation itself. The other half of the trust lives on npmjs.com under the package's Trusted Publisher settings, and it is pinned to this file's *name*. Renaming publish.yml breaks publishing with no other symptom, which the header now says. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This was referenced Aug 5, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switches
publish.ymlfrom a storedNPM_TOKENto trusted publishing (OIDC). npm trades the short-lived token GitHub mints for this specific workflow run for permission to publish, so there is no long-lived credential in the repository to leak, rotate or forget — and none had to be minted, since the secret was never added.Two things that would have failed quietly
Node 22 bundles npm 10, which predates trusted publishing and falls back to looking for a token that no longer exists — an auth failure that reads as a credential problem rather than a version one. npm is now upgraded first, and the 11.5.1 floor is checked rather than assumed.
The check compares with
sort -V, because lexically11.16.0sorts below11.5.1. Verified across the boundary:--provenanceis removed — trusted publishing generates and attaches the attestation itself, so the flag is redundant.Required before the next release
moshcodepackage → Settings → Trusted Publisher → GitHub Actions, with:moshcodermoshcodepublish.ymlnpm publishIt is pinned to the workflow filename, so renaming
publish.ymlbreaks publishing with no other symptom. The header now says so.Verification
contents: read+id-token: writesecrets.reference remains anywhere in the fileNote: npm does not allow an initial version to be published over OIDC, which does not apply here —
moshcode@0.24.0already exists.🤖 Generated with Claude Code