Skip to content

ci: publish to npm via Trusted Publishing (OIDC) #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
baransu merged 2 commits into from
Jun 2, 2026
Merged

ci: publish to npm via Trusted Publishing (OIDC) #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d4d8676
ci: publish to npm via Trusted Publishing (OIDC)
baransu Jun 2, 2026
b36315b
ci: migrate from yarn to npm
baransu Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 35 additions & 19 deletions .github/workflows/publish-package.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,16 +22,16 @@ jobs:
uses: actions/setup-node@v3
with:
node-version: "18.15"
cache: "yarn"
cache: "npm"
Copy link
Copy Markdown

@enzomonjardin enzomonjardin Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

welcomed change.


- name: Install
run: yarn install --frozen-lockfile --non-interactive
run: npm ci

- name: Build
run: yarn build
run: npm run build

- name: Lint
run: yarn lint
run: npm run lint

deploy-github-pages:
runs-on: ubuntu-latest
Expand All @@ -46,22 +46,22 @@ jobs:
uses: actions/setup-node@v3
with:
node-version: "18.15"
cache: "yarn"
cache: "npm"

# Build base package, so links work
- name: Install
run: yarn install --frozen-lockfile --non-interactive
run: npm ci

- name: Build
run: yarn build
run: npm run build

# For the mobx example
- name: Install
run: yarn install --frozen-lockfile --non-interactive
run: npm ci
working-directory: ./docs/todo-mobx-example

- name: Build
run: yarn build
run: npm run build
working-directory: ./docs/todo-mobx-example

- name: Copy output
Expand All @@ -78,6 +78,13 @@ jobs:
if: github.event.pull_request.merged == true && (contains(github.event.pull_request.labels.*.name, 'release-major') || contains(github.event.pull_request.labels.*.name, 'release-minor') || contains(github.event.pull_request.labels.*.name, 'release-patch'))
needs: build-and-lint
runs-on: ubuntu-latest
# `id-token: write` lets GitHub mint the OIDC token that npm exchanges
# for a short-lived publish credential (npm Trusted Publishing) — no
# long-lived NPM_TOKEN secret required. `contents: write` is still
# needed for the GitHub Release created via GITHUB_TOKEN below.
permissions:
id-token: write
contents: write
steps:
- name: Determine version type from label
id: version-type
Expand Down Expand Up @@ -116,28 +123,34 @@ jobs:
git config user.email github-actions@github.com

- name: Setup Node
uses: actions/setup-node@v3
uses: actions/setup-node@v4
with:
node-version: "18.15"
cache: "yarn"
node-version: "24"
cache: "npm"
registry-url: "https://registry.npmjs.org"

# npm Trusted Publishing (OIDC) requires npm >= 11.5.1, which is newer
# than the npm bundled with Node 24. Upgrade explicitly so `npm publish`
# can mint provenance and exchange the OIDC token for a publish credential.
- name: Ensure npm supports Trusted Publishing
run: npm install -g npm@latest

- name: Install dependencies
run: yarn install --frozen-lockfile --non-interactive
run: npm ci

- name: Build
run: yarn build
run: npm run build

- name: Tag release
id: bump-version
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
VERSION_TYPE="${{ steps.version-type.outputs.type }}"
yarn version --"$VERSION_TYPE" --no-git-tag-version
npm version "$VERSION_TYPE" --no-git-tag-version
NEW_VERSION=$(node -p "require('./package.json').version")
echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
git add package.json
git add package.json package-lock.json
git commit -m "release: bump version to $NEW_VERSION"
git tag v$NEW_VERSION
git push --tags origin main
Expand All @@ -152,7 +165,10 @@ jobs:
draft: false
prerelease: false

# Publish via npm Trusted Publishing (OIDC). No NPM_TOKEN secret needed —
# the `id-token: write` permission on this job lets npm exchange a
# short-lived GitHub OIDC token for a publish credential, and provenance
# is attached automatically. Must use the npm CLI here: Yarn Classic's
# `yarn publish` does not support OIDC.
- name: Publish to NPM
run: yarn publish
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: npm publish
8 changes: 4 additions & 4 deletions .github/workflows/test-and-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,13 +17,13 @@ jobs:
uses: actions/setup-node@v3
with:
node-version: "18.15"
cache: "yarn"
cache: "npm"

- name: Install
run: yarn install --frozen-lockfile --non-interactive
run: npm ci

- name: Build
run: yarn build
run: npm run build

- name: Lint
run: yarn lint
run: npm run lint
Loading
Loading