Repository navigation
ci(release): publish the CLI to npm through trusted publishing - #93
Merged
Merged
Conversation
Publish with the job's OIDC token instead of a long-lived NPM_TOKEN. The publish job gets id-token: write, upgrades npm to 11 (trusted publishing needs 11.5.1+), packs with pnpm so workspace ranges are rewritten, and publishes the tarball with npm, which attaches provenance. The package now declares its repository, which provenance verification requires.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switch the
skillx-shCLI release to npm trusted publishing. The publish job exchanges its GitHub OIDC token for a short-lived npm credential, so the long-livedNPM_TOKENsecret is no longer used.publishjob getsid-token: writeandcontents: read.pnpm packrewrites theworkspace:ranges, thennpm publishuploads the tarball. Provenance is attached automatically.packages/cli/package.jsonnow declaresrepository(withdirectory), which provenance verification requires.Before merging
Configure the trusted publisher on npmjs.com, under skillx-sh → Settings → Trusted publishing → GitHub Actions:
nextlevelbuilderskillxrelease-cli.ymlIf this merges before that is configured, the next release's publish step fails with 401/404 and nothing is published.
Context: npm still has 0.3.0 while main is already 0.4.1, so the 0.4.x releases never reached npm. #62 (0.5.0) publishes through this path once it merges.
Verification
pnpm install --frozen-lockfileandpnpm packinpackages/cliproduceskillx-sh-0.4.1.tgz, whosepackage.jsoncontainsrepository. The OIDC exchange itself can only be verified by a real release run.🤖 Generated with Claude Code