Update gha workflow to use OIDC when publishing to npm#44
Conversation
There was a problem hiding this comment.
Pull request overview
Switch GitHub Actions npm publishing from a long-lived npm token to OIDC-based authentication to avoid token rotation and invalidation issues.
Changes:
- Adds
id-token: writepermission to enable OIDC token minting for the publish job - Updates workflow comments to reflect OIDC usage
- Removes
NODE_AUTH_TOKENsecret usage fromnpm publish
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@gnakaki-vs I think you might need to force push the version tag to move it to this PR branch/commit in order to trigger the whole release process. |
|
Thanks for that input, @kanaka . I've updated and pushed the v2.5.8 tag. Great to be working with you again! |
gnakaki-vs
force-pushed
the
OIDC-npm-publishing
branch
from
b3a7860 to
4e44d9c
Compare
|
FYI, I haven't identified the issue with OIDC yet. To unblock things, I've:
I'll continue to look into debugging OIDC. |
gnakaki-vs
force-pushed
the
OIDC-npm-publishing
branch
from
a5c28cd to
c5cb407
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
gnakaki-vs
force-pushed
the
OIDC-npm-publishing
branch
2 times, most recently
from
d538c5d to
8a73ed2
Compare
|
Updated commit based on feedback from npm support, including updated npm version. NPM publish was successful in latest GHA run. |
| - name: Setup Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '20.x' |
There was a problem hiding this comment.
I'm curious if we updated this to 24 (or whatever is the latest LTS), if we wouldn't need to upgrade npm below?
There was a problem hiding this comment.
It looks like Node.js v24.11.0 ships with npm v11.6.1, which would still need to be updated to at least v11.6.4 to support the npm OIDC.
However, node 20 is EOL soon so I can also update that to 24 and test.
Switching npm publishing to use OIDC will resolve an issue where the existing access token is no longer valid while also preventing a need to manage token rotation. We also update node to 24.x as 20 is EOL on April 30, 2026. Version 2.6.3 was released as an intermediate test in development.
gnakaki-vs
force-pushed
the
OIDC-npm-publishing
branch
from
8a73ed2 to
63a7dac
Compare
Switching npm publishing to use OIDC will resolve an issue where the existing access token is no longer valid while also preventing a need to manage token rotation.