From bbf2792d5d606ccba6d1499886658789c00ec4b3 Mon Sep 17 00:00:00 2001 From: Josh Owens Date: Fri, 21 Aug 2026 19:56:34 -0400 Subject: [PATCH] ci: publish via npm CLI OIDC (trusted publishing), not the npm plugin's token path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @semantic-release/npm's verifyConditions hard-requires NPM_TOKEN and fails before npm publish ever runs — but trusted publishing lives in the npm CLI, which authenticates via the workflow's OIDC id-token with no secret at all. Set npmPublish: false (the plugin still handles the version bump, and skips the token check) and publish through @semantic-release/exec running npm publish --provenance. Drops the now-unused NPM_TOKEN env. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GtAjJabU9hUkrzoWF3Xtzm --- .github/workflows/release.yml | 2 +- .releaserc.json | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7018ac0..d50986a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -49,11 +49,11 @@ jobs: @semantic-release/commit-analyzer @semantic-release/release-notes-generator @semantic-release/npm + @semantic-release/exec @semantic-release/github @semantic-release/git env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Release result if: steps.release.outputs.new_release_published == 'true' diff --git a/.releaserc.json b/.releaserc.json index bee79a1..4671557 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -6,7 +6,13 @@ [ "@semantic-release/npm", { - "npmPublish": true + "npmPublish": false + } + ], + [ + "@semantic-release/exec", + { + "publishCmd": "npm publish --provenance --access public" } ], "@semantic-release/github",