ci: authenticate the npm publish with NPM_TOKEN again - #307
Merged
Conversation
Trusted publishing needs a trusted publisher registered against this workflow's filename on npmjs.com, and that can only be done through the web UI. Until it exists npm rejects the publish as E404/no-permission, which is how v0.24.1 failed after the release itself cut cleanly. So: back to a stored automation token in the repository secret NPM_TOKEN, with the explicit check that says which secret is missing rather than leaving an E404 to be read as "the package does not exist". `--provenance` is back too, and `id-token: write` stays with it — the attestation is signed with a short-lived OIDC token even though the publish authenticates with the stored one. The npm upgrade step goes: it existed only because Node 22 bundles an npm too old for trusted publishing, which is no longer the mechanism. Noted in the header for whoever revisits this: npm is restricting tokens that bypass 2FA for direct publishing, so this path has a horizon. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reverts the publish workflow to a stored npm automation token (
NPM_TOKEN).Trusted publishing needs a trusted publisher registered against this workflow's filename on npmjs.com, and that can only be done through the web UI. Until it exists npm rejects the publish as
E404 / no permission— which is exactly how v0.24.1 failed after the release itself cut cleanly.What changed
NPM_TOKENguard restored, so a missing secret says which secret is missing instead of leaving an E404 to be read as "the package does not exist"--provenancerestored, andid-token: writestays with it — the attestation is signed with a short-lived OIDC token even though the publish authenticates with the stored oneEverything else from #304 is untouched: tests first, tag/version match, skip-if-already-published, post-publish registry confirmation.
Worth knowing
npm is restricting tokens that bypass 2FA for direct publishing, so this path has a horizon — noted in the workflow header for whoever revisits it. Trusted publishing remains the eventual destination; it just needs that one web-UI step.
Verification
contents: read+id-token: writeNODE_AUTH_TOKEN🤖 Generated with Claude Code