From 014579a15cf3b09e7815e9b0f28ccbb3cbfdf1ad Mon Sep 17 00:00:00 2001 From: Justin Carper Date: Tue, 29 Sep 2026 11:14:10 -0500 Subject: [PATCH] ci(release): publish to npm with trusted publishing (OIDC) The v0.10.0-next.0 release failed at `npm publish` with E404 on the PUT. The runner had npm 10.9.8, which has no OIDC support, and the NPM_TOKEN secret is no longer the publishing path. Use Node 24.x (bundles npm >= 11.5.1), drop NODE_AUTH_TOKEN from the publish step so npm authenticates through the trusted publisher configured for this repo and release.yml, and update CONTRIBUTING accordingly. --- .github/workflows/release.yml | 7 ++++--- CONTRIBUTING.md | 5 ++++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b33a1b2..222eb05 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -53,7 +53,7 @@ jobs: - name: Set up Node uses: actions/setup-node@v7 with: - node-version: "22.x" + node-version: "24.x" registry-url: "https://registry.npmjs.org" cache: npm @@ -113,6 +113,9 @@ jobs: # Idempotent: re-running the job after a partial failure won't hard-fail # on npm's 409 for an already-published version. + # Publishes via npm trusted publishing (OIDC): needs `id-token: write` + # and npm >= 11.5.1; the trusted publisher is configured on npmjs.com for + # this repo and `release.yml`; no NPM_TOKEN secret is involved. - name: Publish to npm run: | PKG="$(node -p "require('./package.json').name")" @@ -122,8 +125,6 @@ jobs: else npm publish --provenance --access public --tag "${{ steps.version.outputs.NPM_TAG }}" fi - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Create GitHub Release uses: softprops/action-gh-release@v3 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index eaf8685..596a798 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -62,11 +62,14 @@ The release job will: 3. Publish to npm with [provenance attestation](https://docs.npmjs.com/generating-provenance-statements). 4. Create a GitHub Release with auto-generated release notes. +npm publishing uses [trusted publishing (OIDC)](https://docs.npmjs.com/trusted-publishers) +configured on npmjs.com for this repository (`stablekernel/opencode-cursor`, workflow +`release.yml`), so no npm token secret is needed. + **Required repository secrets** (Settings → Secrets → Actions): | Secret | Purpose | | --- | --- | -| `NPM_TOKEN` | npm automation token with `publish` access | | `CURSOR_API_KEY` | (optional) live-path integration test during release | **Pre-publish checklist:** update `CHANGELOG.md`, confirm `version` in