Skip to content
This repository was archived by the owner on Jun 16, 2026. It is now read-only.

ci: switch npm publish to OIDC trusted publishing #10

Draft
mcp-tool-shop wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

ci: switch npm publish to OIDC trusted publishing #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Release

# Fires on git tags shaped like v1.0.0, v1.0.1, v1.1.0, etc.
# - Builds + verifies (tests).
# - Publishes to npm with --provenance (uses NPM_TOKEN secret).
# - Publishes to npm with --provenance via npm Trusted Publishing (OIDC).
# - Creates a GitHub Release with auto-generated notes.

on:
Expand Down Expand Up @@ -62,10 +62,14 @@ jobs:
fi
echo "CLI version smoke: $BUILT_VERSION"

# OIDC trusted publishing requires npm >= 11.5.1; Node 20 bundles
# npm 10.x, so upgrade the global npm before the publish call.
- name: Upgrade npm for OIDC trusted publishing (>= 11.5.1)
run: npm install -g npm@latest

- name: Publish to npm (with provenance)
# Auth via npm Trusted Publishing (OIDC) - intentionally NO NODE_AUTH_TOKEN.
run: npm publish --provenance --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

- name: Create GitHub Release
env:
Expand Down