From ddd895f17d4bfcb9933e9ae0e2b07d77534f86ed Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 11 Aug 2026 08:20:44 +0000 Subject: [PATCH] ci: publish to NPM through trusted publishing The release job had no NPM credentials at all since NPM_TOKEN was dropped in 3690bd1, so `changeset publish` failed with ENEEDAUTH for every package once the devEngines blocker was out of the way. The changesets action logged it plainly: "No NPM_TOKEN or OIDC available - assuming npm is already authenticated". Grant the job an OIDC token so the action takes its trusted publishing path instead, which needs no long-lived token. Declaring permissions narrows them from the permissive default, so the contents and pull-requests scopes the action already used are spelled out as well. Requires a trusted publisher configured on npmjs.com for each published package, pointing at this repository and this workflow file. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01P2UZcjV4P98WFjzfRfLQvx --- .github/workflows/release.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6774fc31..7e51feae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,6 +22,13 @@ jobs: name: Release runs-on: macos-latest environment: main + # Publishing to NPM happens through trusted publishing, which needs an OIDC + # token. Declaring permissions at all narrows them to exactly what is listed, + # so the two the changesets action already relied on are spelled out too. + permissions: + contents: write # version commits, git tags and GitHub releases + pull-requests: write # the "Version Packages" pull request + id-token: write # NPM trusted publishing steps: - uses: actions/checkout@v4 - uses: pnpm/action-setup@v4