Skip to content

ci(release): npm and crates.io via OIDC trusted publishing#13

Merged
dpezto merged 1 commit into
mainfrom
ci/oidc-npm-crates
Jul 23, 2026
Merged

ci(release): npm and crates.io via OIDC trusted publishing#13
dpezto merged 1 commit into
mainfrom
ci/oidc-npm-crates

Conversation

@dpezto

@dpezto dpezto commented Jul 23, 2026

Copy link
Copy Markdown
Owner

Extends OIDC trusted publishing to the npm and crates.io release jobs, removing the long-lived NPM_TOKEN and CARGO_REGISTRY_TOKEN from the release path. The PyPI job already moved to OIDC on main.

Approach

tree-sitter/workflows' package-npm.yml and package-crates.yml require their token secrets and expose no id-token permission, and a caller cannot inject permissions into a reusable workflow's internal jobs. The upstream fix (tree-sitter/workflows#54) is an unmerged draft, so both workflows are vendored here with that patch applied and adapted per registry:

  • npm — token secret optional; publish job carries id-token: write; npm is upgraded to a trusted-publishing-capable release (>= 11.5.1) before publish, since the bundled npm predates OIDC support. With NODE_AUTH_TOKEN unset, npm publish authenticates through the OIDC id-token.
  • crates.io — token secret optional; publish job carries id-token: write. With no token set, rust-lang/crates-io-auth-action mints a short-lived token via OIDC, which cargo publish then uses.

release.yml calls the local copies, grants contents: read + id-token: write to each reusable workflow, and no longer passes the token secrets.

Requires

A GitHub trusted publisher configured on each registry before the next release: workflow release.yml, environments npm and crates respectively. Until each publish is confirmed green, the classic token secrets can remain as a rollback (setting the secret re-enables token auth without a workflow change).

Extend OIDC trusted publishing to the npm and crates.io release jobs, removing
the long-lived NPM_TOKEN and CARGO_REGISTRY_TOKEN from the release path (the
PyPI job already moved to OIDC).

As with PyPI, tree-sitter/workflows' package-npm.yml and package-crates.yml
require their token secrets and expose no id-token permission, and the upstream
fix (tree-sitter/workflows#54) is an unmerged draft, so both are vendored here
with that patch applied and adapted per registry:

- npm: the auth token is optional and the publish job carries id-token: write.
  npm is upgraded to a trusted-publishing-capable release (>= 11.5.1) before
  publish, since the bundled npm predates OIDC support. When NODE_AUTH_TOKEN is
  unset, npm publish authenticates through the OIDC id-token.
- crates.io: the registry token is optional and the publish job carries
  id-token: write. When no token is set, rust-lang/crates-io-auth-action mints
  a short-lived token via OIDC, which cargo publish then uses.

release.yml calls the local copies, grants contents: read + id-token: write to
each reusable workflow, and no longer passes the token secrets. Both require a
GitHub trusted publisher configured on the respective registry (workflow
release.yml; environments npm and crates).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 23, 2026 20:39

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions github-actions Bot added the size/xl huge — split or scrutinize label Jul 23, 2026
@dpezto
dpezto merged commit afdcf1c into main Jul 23, 2026
4 checks passed
@dpezto
dpezto deleted the ci/oidc-npm-crates branch July 23, 2026 20:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/xl huge — split or scrutinize

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants