ci: switch to npm trusted publishing (OIDC) - #194
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe project now targets Node.js 22, updates its Node.js type definitions, standardizes CI and release runtimes, and configures npm releases to use OIDC trusted publishing. ChangesNode 22 and npm publishing
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- Add id-token: write permission for OIDC-based npm auth - Remove NODE_AUTH_TOKEN secret from publish step - Install npm@^12 in release workflow (trusted publishing requires >= 11.5.1) - Bump Node from 20 to 22 in CI and release workflows - Add engines.node >= 22.14.0 to package.json - Update @types/node to ^22.0.0 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
066ce08 to
3439e9a
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yaml (1)
33-34: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the npm CLI version used for releases.
npm install npm@^12 -gbypasses lockfile control and can resolve different npm releases over time, making publishing behavior non-reproducible. Pin a vetted npm 12 patch version and verify its compatibility with Node.js 22.14.0.As per path instructions: “Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yaml around lines 33 - 34, Pin the npm CLI installation in the “Use npm 12” workflow step to a vetted, exact npm 12 patch version compatible with Node.js 22.14.0, replacing the ^12 range so release behavior is reproducible.Sources: Path instructions, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yaml:
- Around line 10-12: Move contents: write and id-token: write from
workflow-level permissions into a dedicated publish job that performs npm
trusted publishing and release creation. Keep build, changelog, and other
third-party action jobs least-privileged with only the permissions they require,
and ensure the publish job receives the necessary build artifacts and runs after
validation.
---
Nitpick comments:
In @.github/workflows/release.yaml:
- Around line 33-34: Pin the npm CLI installation in the “Use npm 12” workflow
step to a vetted, exact npm 12 patch version compatible with Node.js 22.14.0,
replacing the ^12 range so release behavior is reproducible.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b1701ef6-2243-4db8-80bd-df34d331187e
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (3)
.github/workflows/ci.yaml.github/workflows/release.yamlpackage.json
| permissions: | ||
| contents: write # Required for creating releases | ||
| id-token: write # Required for npm trusted publishing (OIDC) |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Scope OIDC and write permissions to a dedicated publish job.
Workflow-level id-token: write and contents: write are inherited by every step, including third-party changelog and release actions. A compromised action could mint the trusted-publishing identity or modify releases. Separate publishing into a minimal job with id-token: write, leaving build and release steps least-privileged.
As per path instructions: “Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yaml around lines 10 - 12, Move contents: write
and id-token: write from workflow-level permissions into a dedicated publish job
that performs npm trusted publishing and release creation. Keep build,
changelog, and other third-party action jobs least-privileged with only the
permissions they require, and ensure the publish job receives the necessary
build artifacts and runs after validation.
Source: Path instructions
1 participant
Followed instructions from https://docs.npmjs.com/trusted-publishers
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com