Skip to content

ci: switch to using OIDC for publishing releases #415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

ci: switch to using OIDC for publishing releases #415

wants to merge 1 commit into from

Conversation

@G-Rath
Copy link
Collaborator

@G-Rath G-Rath commented Oct 23, 2025 •
edited
Loading

What:

This

  • bumps the version of Node when publishing to v22, as that is required by semantic-release v25
  • uses semantic-release v25 for publishing, as that version supports OIDC authentication
  • ensures the release job has the needed permissions for publishing with OIDC
  • ensures npm v11.5.1 or higher is installed as that is the first version that introduced support for OIDC publishing
  • removes the use of the NPM token, since OIDC is now used for authentication

Why:

Publishing tokens are now going to have a max expiration of 90 days, making them not suitable for CI-based publishing.

OIDC is also generally more secure and allows publishing with provenance

How:

Checklist:

  • Documentation
  • Tests
  • Ready to be merged

@G-Rath
Copy link
Collaborator Author

G-Rath commented Oct 23, 2025

@MichaelDeBoey @Belco90 someone with access to the NPM package will need to setup the trusted publisher, similar to this.

Once that is done, I'll mark this as ready-for-review

@Belco90
Copy link
Member

Belco90 commented Oct 27, 2025

@MichaelDeBoey @Belco90 someone with access to the NPM package will need to setup the trusted publisher, similar to this.

Once that is done, I'll mark this as ready-for-review

I'm afraid I don't have access to this. It's published under @benmonro account on npm registry.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kentcdodds kentcdodds Awaiting requested review from kentcdodds

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@G-Rath @Belco90