From 42153c53f98cd1b27aa391d14b6c3b4254aa8e83 Mon Sep 17 00:00:00 2001 From: mcp-tool-shop <64996768+mcp-tool-shop@users.noreply.github.com> Date: Tue, 2 Jun 2026 03:52:38 -0400 Subject: [PATCH] ci: switch npm publish to OIDC trusted publishing This repo's release.yml authenticated npm publish via NODE_AUTH_TOKEN wired to the NPM_TOKEN secret. That pattern failed in prod on 2026-06-02 when @mcptoolshop/backprop-trace's NPM_TOKEN expired (npm masks an expired token as E404, not 403). Switch to npm Trusted Publishing (OIDC), matching the proven backprop-trace fix: remove NODE_AUTH_TOKEN/NPM_TOKEN from the publish step; add npm install -g npm@latest (OIDC needs npm >= 11.5.1; Node 22 ships 10.9.x); keep id-token: write and npm publish --provenance --access public. Inert until a Trusted Publisher is configured on npmjs.com for @mcptoolshop/ai-loadout bound to ai-loadout / release.yml. The NPM_TOKEN secret is intentionally retained as a revert path until the first OIDC release is confirmed. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 786603b..9ee3124 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,7 +2,7 @@ name: Release # Fires on git tags shaped like v1.0.0, v1.0.1, v1.1.0, etc. # - Builds + verifies (tests). -# - Publishes to npm with --provenance (uses NPM_TOKEN secret). +# - Publishes to npm with --provenance via npm Trusted Publishing (OIDC). # - Creates a GitHub Release with auto-generated notes. on: @@ -62,10 +62,14 @@ jobs: fi echo "CLI version smoke: $BUILT_VERSION" + # OIDC trusted publishing requires npm >= 11.5.1; Node 20 bundles + # npm 10.x, so upgrade the global npm before the publish call. + - name: Upgrade npm for OIDC trusted publishing (>= 11.5.1) + run: npm install -g npm@latest + - name: Publish to npm (with provenance) + # Auth via npm Trusted Publishing (OIDC) - intentionally NO NODE_AUTH_TOKEN. run: npm publish --provenance --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Create GitHub Release env: