Repository navigation
ci: publish to npm via Trusted Publishing (OIDC) instead of NPM_TOKEN - #193
Conversation
npm is deprecating 2FA-bypass granular access tokens for direct publishing (January 2027), and the v3.1.0 publish already fails with EOTP because the account requires 2FA. Switch the publish workflow to Trusted Publishing: drop NODE_AUTH_TOKEN from the publish step, bump actions/setup-node to v7 so no placeholder token is written to .npmrc, upgrade npm to >= 11.5.1 on the runner, and point recovery messages and docs/RELEASE.md at the Trusted Publisher configuration.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 18 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security review: no medium, high, or critical issues in this diff.
Publishing now uses the job’s GitHub OIDC identity instead of a stored NPM_TOKEN. The new steps (actions/setup-node@v7 and npm install -g npm@latest) do not pass attacker-controlled input into a sink, and the job still runs only after a merged release/* pull request. I did not find an auth bypass, token leak, injection, or other exploitable path in the changed lines.
Sent by Cursor Automation: PR review - Find vulnerabilities
There was a problem hiding this comment.
Security review: one medium supply-chain finding in the new publish path. Removing the long-lived NPM_TOKEN and publishing with OIDC is sound. No high or critical issues, and there were no earlier automation review threads to re-open.
The remaining issue is the unpinned npm install -g npm@latest step inside the job that has id-token: write. Current Node LTS already ships npm 11.19.0, which meets the Trusted Publishing minimum, so this upgrade is not required.
Sent by Cursor Automation: Find vulnerabilities
|
|
||
| - name: Ensure npm supports Trusted Publishing (>= 11.5.1) | ||
| run: | | ||
| npm install -g npm@latest |
There was a problem hiding this comment.
Medium — unpinned npm@latest executes with npm publish OIDC
This step installs whatever the registry currently tags latest (npm 12.2.0 today, including its bundled dependency tree). The same step then runs that binary (npm --version), and the later npm publish --provenance step runs it again. The job has id-token: write, so that process can request a GitHub OIDC token for publish-on-merge.yml. Once this workflow is a Trusted Publisher, npm will exchange that token for a credential that can publish webfinger.js.
node-version: 'lts/*' is Node 24.21.0, which already includes npm 11.19.0 (above the 11.5.1 Trusted Publishing minimum). Nothing in this job needs a floating upgrade. A compromised npm release is fetched and executed on the next merged release/* PR and can upload a tampered package under a valid provenance attestation.
Pin an exact npm version, or drop this step and publish with the npm that ships with Node 24.
Closes #188 once v3.1.0 is published.
Why
The v3.1.0 publish (run 37653554926) fails with
EOTP: the npm account requires 2FA and the granular token can't bypass it. npm is deprecating 2FA-bypass tokens for direct publishing (January 2027), so fixing the token would only buy a few months. Trusted Publishing (OIDC) needs no stored secret and already produces the provenance attestation the workflow asks for.Changes
publish-on-merge.ymlNODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}from the publish step.actions/setup-nodev4 → v7, which no longer writes a placeholder_authTokento.npmrcthat would override OIDC.NPM_TOKEN.docs/RELEASE.md: setup and troubleshooting now describe Trusted Publishing; note that the workflow must be onmasterfor the publisher to match.One-time setup required before this works
webfinger.js→ Settings → Trusted Publisher → GitHub Actions. Ownersilverbucket, repositorywebfinger.js, workflow filenamepublish-on-merge.yml, environment blank.NPM_TOKENandNODE_AUTH_TOKENrepository secrets.Publishing v3.1.0
Re-running the old failed run uses the old workflow file, so it won't pick this up. Either publish 3.1.0 once by hand (
npm loginthennpm publishfrom thev3.1.0tag;prepublishOnlyrebuildsdist/), or re-open and re-merge arelease/v3.1.0PR after this lands so the new workflow runs. The workflow's "already published" check keeps the tag/release steps idempotent either way.