ci: publish by trusted publishing again - #309
Merged
Merged
Conversation
Back to OIDC: npm trades the short-lived token GitHub mints for this specific workflow run for permission to publish, so there is no long-lived credential in the repository at all. This is the version from 18d9084, restored, plus the failure signature we did not have the first time. When the trusted publisher is not registered there is no credential in the run, and npm reports that as: npm error code E404 ... could not be found or you do not have permission which names neither OIDC nor trusted publishing and reads as though the package does not exist. The header now says what it actually means, because that cost a release to work out. The E422 that stopped v0.24.1 is unrelated and already fixed: package.json now carries the `repository` field provenance is checked against. Still requires the publisher to be registered on npmjs.com against this file's name, `publish.yml`. Nothing in the repository can verify that — the registry does not expose it — so the next release is the proof. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This was referenced Aug 6, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switches the publish workflow back to trusted publishing (OIDC). npm trades the short-lived token GitHub mints for this specific workflow run for permission to publish, so there is no long-lived credential in the repository at all.
This is the version from
18d9084restored, plus one addition below.What is new versus last time
The first attempt failed in a way that named neither OIDC nor trusted publishing:
With no publisher registered there is no credential in the run at all, and npm reports it as though the package does not exist. The workflow header now spells that out, because working it out cost a release.
Unrelated, already fixed
The E422 that stopped v0.24.1 was a different problem — missing
repositoryinpackage.json, which provenance is validated against. That landed in #308, and v0.24.2 published successfully with a SLSA attestation. Provenance stays automatic under trusted publishing, so the explicit--provenanceflag is gone.Still required
The publisher must be registered on npmjs.com for the
moshcodepackage, against this file's name —publish.yml:moshcodermoshcodepublish.ymlnpm publishNothing in the repo can verify this — the registry does not expose trusted-publisher config, which I checked. The next release is the proof. A dispatch run cannot test it, because 0.24.2 is already published and the skip guard would stop before the publish.
Verification
contents: read+id-token: writesecrets.references remain--provenancecorrectly absent from the publish command (comment only)🤖 Generated with Claude Code