Skip to content

ci: switch to npm trusted publishing (OIDC) #194

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fbricon wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: switch to npm trusted publishing (OIDC) #194

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,10 @@ jobs:
- uses: actions/checkout@v4

# Set up Node
- name: Use Node 20
- name: Use Node 22
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 22
registry-url: 'https://registry.npmjs.org'

# Run install dependencies
Expand Down
22 changes: 11 additions & 11 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,16 +7,15 @@ on:
- '*'

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
permissions:
contents: write # Required for creating releases
id-token: write # Required for npm trusted publishing (OIDC)
Comment on lines +10 to +12

@coderabbitai coderabbitai Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Scope OIDC and write permissions to a dedicated publish job.

Workflow-level id-token: write and contents: write are inherited by every step, including third-party changelog and release actions. A compromised action could mint the trusted-publishing identity or modify releases. Separate publishing into a minimal job with id-token: write, leaving build and release steps least-privileged.

As per path instructions: “Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.”

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yaml around lines 10 - 12, Move contents: write
and id-token: write from workflow-level permissions into a dedicated publish job
that performs npm trusted publishing and release creation. Keep build,
changelog, and other third-party action jobs least-privileged with only the
permissions they require, and ensure the publish job receives the necessary
build artifacts and runs after validation.

Source: Path instructions


jobs:
# This workflow contains a single job called "build"
build:
# The type of runner that the job will run on
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest]
permissions:
contents: write # Required for creating releases
runs-on: ubuntu-latest
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
Expand All @@ -25,12 +24,15 @@ jobs:
fetch-depth: 0 # Fetch full history for changelog generation

# Set up Node
- name: Use Node 20
- name: Use Node 22
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 22
registry-url: 'https://registry.npmjs.org'

- name: Use npm 12
run: npm install npm@^12 -g

# Run install dependencies
- name: Install dependencies
run: npm ci
Expand Down Expand Up @@ -79,8 +81,6 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# Publish to npm
# Publish to npm using trusted publishing (OIDC)
- name: Publish to npm
run: npm publish --access public
env:
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
36 changes: 20 additions & 16 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 4 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@
"version": "0.11.0",
"description": "Provides Telemetry APIs for Red Hat applications",
"main": "lib/index.js",
"engines": {
"node": ">=22.14.0"
},
"types": "lib",
"scripts": {
"clean": "node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\"",
Expand Down Expand Up @@ -41,7 +44,7 @@
"@commitlint/cli": "^21.2.1",
"@commitlint/config-conventional": "^21.2.0",
"@types/getos": "^3.0.1",
"@types/node": "^20.14.8",
"@types/node": "^22.0.0",
"@types/object-hash": "^3.0.2",
"@types/picomatch": "^4.0.0",
"@types/ua-parser-js": "^0.7.36",
Expand Down
Loading