From dc1137c910f46d9fc5070d94d9da1eabc82aed84 Mon Sep 17 00:00:00 2001 From: Maryam Date: Sun, 25 Oct 2026 17:22:42 +0100 Subject: [PATCH 1/2] fix(ci): engage npm Trusted Publishing on Node 24 (#43) --- .github/workflows/npm-publish.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 1682084..7325e34 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -1,20 +1,22 @@ name: Publish Package to npmjs on: + release: + types: [ published ] workflow_dispatch: -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true jobs: build: runs-on: ubuntu-latest + # npm Trusted Publishing (OIDC): id-token mints the per-run credential; no NODE_AUTH_TOKEN. + permissions: + id-token: write + contents: read steps: - uses: actions/checkout@v6 # Setup .npmrc file to publish to npm - uses: actions/setup-node@v6 with: - node-version: '22.x' + node-version: '24' registry-url: 'https://registry.npmjs.org' - run: npm ci - - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + - run: npm publish --provenance --access public From 8caa67a0265b3a168fcd9cda474acbc0715e70a5 Mon Sep 17 00:00:00 2001 From: Maryam Date: Sun, 25 Oct 2026 18:28:53 +0100 Subject: [PATCH 2/2] fix(ci): keep workflow_dispatch only and plain npm publish (#43) --- .github/workflows/npm-publish.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 7325e34..e74f43d 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -1,7 +1,5 @@ name: Publish Package to npmjs on: - release: - types: [ published ] workflow_dispatch: jobs: @@ -19,4 +17,4 @@ jobs: node-version: '24' registry-url: 'https://registry.npmjs.org' - run: npm ci - - run: npm publish --provenance --access public + - run: npm publish