From 384b4ef9204d46895ac1c0ee890e5c12240d1bf3 Mon Sep 17 00:00:00 2001 From: =?utf8?q?J=C3=A9r=C3=B4me=20Benoit?= Date: Mon, 16 Feb 2026 19:27:11 +0100 Subject: [PATCH] ci: migrate npm publish to OIDC Trusted Publisher --- .github/workflows/release-please.yml | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 3f7f80f03..97bb0bc42 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -88,6 +88,10 @@ jobs: needs: build-release runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + steps: - name: Checkout uses: actions/checkout@v6 @@ -111,26 +115,18 @@ jobs: - name: Publish Release if: ${{ contains(steps.package-version.outputs.version, '-') == false }} run: pnpm publish --no-git-checks - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish Release Candidate if: ${{ contains(steps.package-version.outputs.version, '-rc') == true }} run: pnpm publish --no-git-checks --tag next - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish Beta Release if: ${{ contains(steps.package-version.outputs.version, '-beta') == true }} run: pnpm publish --no-git-checks --tag beta - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish Alpha Release if: ${{ contains(steps.package-version.outputs.version, '-alpha') == true }} run: pnpm publish --no-git-checks --tag alpha - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} publish-documentation: needs: [publish-npm, publish-jsr] -- 2.53.0