Skip to content

ci(release): publish to npm via Trusted Publishing OIDC #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joaner merged 1 commit into from
Aug 26, 2026
Merged

ci(release): publish to npm via Trusted Publishing OIDC #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@ jobs:
needs: validate
runs-on: ubuntu-latest
permissions:
id-token: write
id-token: write # OIDC for npm Trusted Publishing
contents: read
steps:
- uses: actions/checkout@v7

Expand All @@ -53,10 +54,10 @@ jobs:
name: dist-lib
path: dist-lib/

# Authenticate via npm Trusted Publishing (OIDC). Do not set
# NODE_AUTH_TOKEN here — classic publish tokens are deprecated.
- name: Publish
run: npm publish --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

github-release:
name: Create GitHub Release
Expand Down
22 changes: 13 additions & 9 deletions docs/RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,14 @@ Publishing is fully automated: once you push a version tag, GitHub Actions handl
## Prerequisites

- You must have push access to the `main` branch and tag creation rights.
- The `NPM_TOKEN` secret must be set in the GitHub repository settings (Settings > Secrets > Actions).
The token must have **Publish** scope for the npm scope used by this package (e.g. `@ioai`).
- **npm Trusted Publishing** must be configured for `@ioai/rosview` on [npmjs.com](https://www.npmjs.com):
- Publisher: **GitHub Actions**
- Organization or user: `ioai-tech`
- Repository: `rosview`
- Workflow filename: `release.yml`
- Allowed actions: **npm publish**
- Tags must be pushed to **`ioai-tech/rosview`** (GitHub-hosted runners only).
- npm CLI **≥ 11.5.1** (Node 24 in CI satisfies this).

---

Expand Down Expand Up @@ -45,7 +51,7 @@ Go to **Actions** tab on GitHub and watch the `Release` workflow:
| Job | What it does |
|-----|-------------|
| `validate` | Runs lint, unit tests, full SPA build, and library build |
| `publish-npm` | Publishes `@ioai/rosview` to npm (requires `NPM_TOKEN`) |
| `publish-npm` | Publishes `@ioai/rosview` to npm via Trusted Publishing (OIDC) |
| `github-release` | Creates a GitHub Release with GitHub auto-generated release notes |

If any job fails, fix the issue and re-push the tag:
Expand Down Expand Up @@ -86,10 +92,8 @@ The release workflow automatically marks releases as **pre-release** on GitHub w

---

## Required GitHub secrets
## npm authentication

| Secret | Description |
|--------|-------------|
| `NPM_TOKEN` | npm automation token with Publish scope for the package's npm organization / scope |

Set it at: **Repository -> Settings -> Secrets and variables -> Actions -> New repository secret**
Publishing uses **Trusted Publishing** (OIDC) — no `NPM_TOKEN` secret is required for
`npm publish`. If CI ever needs to install private npm dependencies during `npm ci`,
use a separate **read-only** token via `NPM_READ_TOKEN` on the install step only.