-
Notifications
You must be signed in to change notification settings - Fork 8
feat: enable npm Trusted Publishers #79
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Greptile SummaryThis PR migrates npm publishing from token-based authentication to OIDC-based Trusted Publishers, improving security by eliminating the need to manage
Note: This requires npm Trusted Publishers to be configured on the npm registry side for the Confidence Score: 4/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant GH as GitHub Actions
participant OIDC as GitHub OIDC Provider
participant NPM as npm Registry
GH->>GH: Release event triggers workflow
GH->>GH: Checkout & setup Node 24
GH->>GH: npm install & build
GH->>OIDC: Request OIDC token (id-token: write)
OIDC-->>GH: Return signed JWT
GH->>NPM: npm publish --provenance (with OIDC token)
NPM->>NPM: Verify OIDC token against Trusted Publishers
NPM->>NPM: Generate provenance attestation
NPM-->>GH: Publish successful
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
1 file reviewed, 2 comments
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 18 | ||
| node-version: 24 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
style: CI workflow uses Node 20, but release uses Node 24. Consider aligning versions to catch potential compatibility issues during CI before release.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 25:25
Comment:
**style:** CI workflow uses Node 20, but release uses Node 24. Consider aligning versions to catch potential compatibility issues during CI before release.
How can I resolve this? If you propose a fix, please make it concise.| shell: bash | ||
|
|
||
| jobs: | ||
| test: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
style: Job name test is misleading since it publishes to NPM. Consider renaming to publish or release for clarity.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/release.yml
Line: 15:15
Comment:
**style:** Job name `test` is misleading since it publishes to NPM. Consider renaming to `publish` or `release` for clarity.
How can I resolve this? If you propose a fix, please make it concise.
Enables npm Trusted Publishers for secure publishing without manual token management.
Changes:
id-token: writepermission for OIDC authentication--provenanceflag to publish commandsNODE_AUTH_TOKENenvironment variable (no longer needed)Benefits: