This repository was archived by the owner on Jun 16, 2026. It is now read-only.
ci: switch npm publish to OIDC trusted publishing - #10
Draft
mcp-tool-shop wants to merge 1 commit into
Draft
Conversation
This repo's release.yml authenticated npm publish via NODE_AUTH_TOKEN wired to the NPM_TOKEN secret. That pattern failed in prod on 2026-06-02 when @mcptoolshop/backprop-trace's NPM_TOKEN expired (npm masks an expired token as E404, not 403). Switch to npm Trusted Publishing (OIDC), matching the proven backprop-trace fix: remove NODE_AUTH_TOKEN/NPM_TOKEN from the publish step; add npm install -g npm@latest (OIDC needs npm >= 11.5.1; Node 22 ships 10.9.x); keep id-token: write and npm publish --provenance --access public. Inert until a Trusted Publisher is configured on npmjs.com for @mcptoolshop/ai-loadout bound to ai-loadout / release.yml. The NPM_TOKEN secret is intentionally retained as a revert path until the first OIDC release is confirmed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switch npm publish to OIDC Trusted Publishing
Why this PR exists. This repo's
release.ymlauthenticatesnpm publishwith aNODE_AUTH_TOKENwired to theNPM_TOKENrepo secret. That model just failed in production: on 2026-06-02,@mcptoolshop/backprop-tracev0.12.0 failed to release with an npm E404 on the registry PUT. Root cause - theNPM_TOKENsecret had expired, and npm masks an expired/under-privileged token as a 404 (not a 403), which hid the real cause. Every repo still on this token pattern will hit the identical failure when its token expires.The fix (identical to the already-proven backprop-trace migration):
NPM_TOKENsecret) from the publish step.npm install -g npm@latestimmediately before publish - OIDC trusted publishing requires npm >= 11.5.1, and Node 22 bundles npm 10.9.x.id-token: writeon the publish job.npm publish --provenance --access public.Proof it works.
@mcptoolshop/backprop-trace@0.12.0is live on npm, published with_npmUser.name: "GitHub Actions"+ atrustedPublisherblock and a SLSA provenance attestation - exactly the end state this PR produces.This PR is intentionally a draft. The code change is inert until a Trusted Publisher exists for the package, and merging without it will make the next release fail (no token, and no trusted publisher to fall back on).
@mcptoolshop/ai-loadout-> Settings -> Trusted Publishers -> add a GitHub Actions publisher:mcp-tool-shop-orgai-loadoutrelease.ymlnpm view @mcptoolshop/ai-loadout@<version> --jsonshows_npmUser.name: "GitHub Actions"and atrustedPublisherblock.NPM_TOKENrepo secret (retained until now as a quick revert path - this PR does not delete it).🤖 Generated with Claude Code