From: Jérôme Benoit <jerome.benoit@piment-noir.org>
Date: Mon, 16 Feb 2026 18:27:11 +0000 (+0100)
Subject: ci: migrate npm publish to OIDC Trusted Publisher
X-Git-Tag: v5.2.0~1
X-Git-Url: https://git.piment-noir.org/?a=commitdiff_plain;h=384b4ef9204d46895ac1c0ee890e5c12240d1bf3;p=poolifier.git

ci: migrate npm publish to OIDC Trusted Publisher
---

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 3f7f80f03..97bb0bc42 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -88,6 +88,10 @@ jobs:
     needs: build-release
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      id-token: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -111,26 +115,18 @@ jobs:
       - name: Publish Release
         if: ${{ contains(steps.package-version.outputs.version, '-') == false }}
         run: pnpm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish Release Candidate
         if: ${{ contains(steps.package-version.outputs.version, '-rc') == true }}
         run: pnpm publish --no-git-checks --tag next
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish Beta Release
         if: ${{ contains(steps.package-version.outputs.version, '-beta') == true }}
         run: pnpm publish --no-git-checks --tag beta
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish Alpha Release
         if: ${{ contains(steps.package-version.outputs.version, '-alpha') == true }}
         run: pnpm publish --no-git-checks --tag alpha
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   publish-documentation:
     needs: [publish-npm, publish-jsr]