From 15f77a608954ff5540a14213341f7730b9734f22 Mon Sep 17 00:00:00 2001 From: Atharva0506 Date: Wed, 5 Aug 2026 15:35:30 +0530 Subject: [PATCH 1/3] ci: migrate npm publish to Trusted Publishing (OIDC) npm is deprecating bypass-2FA token publishing (phased out by Jan 2027), so drop the NPMJS_TOKEN-based auth in favor of OIDC trusted publishing. Requires npm >= 11.5.1, bumped via npm install -g npm@latest. --- .github/workflows/version-release.yml | 25 +++---------------------- 1 file changed, 3 insertions(+), 22 deletions(-) diff --git a/.github/workflows/version-release.yml b/.github/workflows/version-release.yml index f6a373a..53377dd 100644 --- a/.github/workflows/version-release.yml +++ b/.github/workflows/version-release.yml @@ -170,6 +170,9 @@ jobs: node-version: '22' registry-url: 'https://registry.npmjs.org' + - name: Update npm for Trusted Publishing + run: npm install -g npm@11.5.1 + - name: Install dependencies run: npm ci @@ -190,30 +193,8 @@ jobs: - name: Verify package contents run: npm pack --dry-run - - name: Verify npm authentication - env: - NODE_AUTH_TOKEN: ${{ secrets.NPMJS_TOKEN }} - run: | - if [ -z "$NODE_AUTH_TOKEN" ]; then - echo "::error::NPMJS_TOKEN secret is not set. Configure it in repo Settings → Secrets → Actions." - exit 1 - fi - echo "✓ NPMJS_TOKEN secret is present" - echo "Node: $(node -v) | npm: $(npm -v)" - echo "Registry: $(npm config get registry)" - cat ~/.npmrc 2>/dev/null | sed 's/_authToken=.*/_authToken=***/' || true - NPM_USER=$(npm whoami 2>&1) || { - echo "::error::npm authentication failed. The NPMJS_TOKEN may be expired or invalid." - echo "npm whoami output: $NPM_USER" - exit 1 - } - echo "✓ Authenticated as: $NPM_USER" - npm org ls aossie-org "$NPM_USER" 2>&1 || echo "⚠ Could not verify org membership" - - name: Publish to npm run: npm publish --provenance --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPMJS_TOKEN }} - name: Publish Summary run: | From 6f825bb803cea0cd7fc3e479490b674433d140d6 Mon Sep 17 00:00:00 2001 From: Atharva0506 Date: Wed, 5 Aug 2026 16:54:24 +0530 Subject: [PATCH 2/3] ci: split publish into build and publish jobs Untrusted code (dependency installs, build/test scripts) previously ran in the same job as id-token: write, so a compromised dependency could have exfiltrated the OIDC token before the publish step ran. Build and pack the tarball in a job with no token access, then publish it from a minimal job that only handles the tarball and the actual publish call. --- .github/workflows/version-release.yml | 45 +++++++++++++++++++++------ 1 file changed, 36 insertions(+), 9 deletions(-) diff --git a/.github/workflows/version-release.yml b/.github/workflows/version-release.yml index 53377dd..390fa65 100644 --- a/.github/workflows/version-release.yml +++ b/.github/workflows/version-release.yml @@ -149,14 +149,13 @@ jobs: echo "- **GitHub Release:** ✗ (no draft found)" >> $GITHUB_STEP_SUMMARY fi - publish: + build: needs: release if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.release.outputs.released == 'true' }} runs-on: ubuntu-latest permissions: contents: read - id-token: write steps: - name: Checkout code @@ -168,10 +167,6 @@ jobs: uses: actions/setup-node@v4 with: node-version: '22' - registry-url: 'https://registry.npmjs.org' - - - name: Update npm for Trusted Publishing - run: npm install -g npm@11.5.1 - name: Install dependencies run: npm ci @@ -190,11 +185,43 @@ jobs: - name: Run tests run: npm test - - name: Verify package contents - run: npm pack --dry-run + - name: Pack package + run: npm pack --pack-destination /tmp/pack + + - name: Upload package tarball + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + with: + name: npm-package + path: /tmp/pack/*.tgz + retention-days: 1 + + publish: + needs: [release, build] + if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.release.outputs.released == 'true' }} + runs-on: ubuntu-latest + + permissions: + contents: read + id-token: write + + steps: + - name: Download package tarball + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + with: + name: npm-package + path: /tmp/pack + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '22' + registry-url: 'https://registry.npmjs.org' + + - name: Update npm for Trusted Publishing + run: npm install -g npm@11.5.1 - name: Publish to npm - run: npm publish --provenance --access public + run: npm publish /tmp/pack/*.tgz --provenance --access public - name: Publish Summary run: | From e736291e78a773781e115ce6d456aad805e71d44 Mon Sep 17 00:00:00 2001 From: Atharva0506 Date: Wed, 5 Aug 2026 17:04:16 +0530 Subject: [PATCH 3/3] ci: pin actions/setup-node to an immutable commit SHA --- .github/workflows/version-release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/version-release.yml b/.github/workflows/version-release.yml index 390fa65..e72a215 100644 --- a/.github/workflows/version-release.yml +++ b/.github/workflows/version-release.yml @@ -164,7 +164,7 @@ jobs: persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: '22' @@ -212,7 +212,7 @@ jobs: path: /tmp/pack - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: '22' registry-url: 'https://registry.npmjs.org'