From b76fde4588dca8bc8be8feba89153b8774505ab3 Mon Sep 17 00:00:00 2001 From: Alex Bezpalko Date: Wed, 19 Aug 2026 17:56:28 +0200 Subject: [PATCH] [DND-1562] ci: publish @opik/ccsync via trusted publishing (OIDC) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The publish workflow authenticated with secrets.NPM_TOKEN. That no longer works: npm revoked all classic tokens on 2025-12-09, and granular write tokens are now capped at a 90-day lifetime, so a stored secret means quarterly rotation or a broken release. Switch to npm trusted publishing — a short-lived OIDC token minted per run: - id-token: write (plus contents: write, which the existing tag-push step needs) on the publish job; npm matches this workflow's filename, publish.yml, against the trusted publisher configured on npmjs.com - Node 18 -> 22.14.0 and npm -> 11.6.2, the trusted-publishing floor - NODE_AUTH_TOKEN dropped; the setup-node _authToken stub is deleted before publishing so npm falls back to the OIDC exchange - package.json gains `repository`, which the automatic provenance attestation requires (the repo is public, so provenance is generated) - checkout/setup-node bumped off the deprecated v3 runtimes Follow-up outside this repo: configure the trusted publisher for @opik/ccsync on npmjs.com (org comet-ml, repo ccsync, workflow publish.yml) before the next release, then delete the NPM_TOKEN secret. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/publish.yml | 36 +++++++++++++++++++++++++++-------- package.json | 4 ++++ 2 files changed, 32 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6f4a17c..cde588f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -12,16 +12,29 @@ on: jobs: publish: runs-on: ubuntu-latest - + + permissions: + # `contents: write` — the tag step below commits and pushes. + # `id-token: write` — mints the OIDC token npm trusted publishing exchanges + # for a short-lived publish credential. npm matches this workflow's filename + # (publish.yml) against the trusted publisher configured on npmjs.com. + contents: write + id-token: write + steps: - name: Checkout code - uses: actions/checkout@v3 - + uses: actions/checkout@v4 + - name: Setup Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@v4 with: - node-version: '18' + # npm trusted publishing (OIDC) requires Node >= 22.14.0 and npm >= 11.5.1; + # Node 22.14.0 ships npm 10.x, so the npm CLI is bumped explicitly below. + node-version: '22.14.0' registry-url: 'https://registry.npmjs.org' + + - name: Setup npm + run: npm install -g npm@11.6.2 - name: Install dependencies run: npm ci @@ -43,9 +56,16 @@ jobs: fi - name: Publish to NPM - run: npm publish --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + # Authenticated with npm trusted publishing (OIDC), not a token: npm revoked + # all classic tokens on 2025-12-09 and caps granular write tokens at 90 days. + # `npm config delete` removes the `_authToken=${NODE_AUTH_TOKEN}` stub that + # setup-node writes into ~/.npmrc — with no token set, npm would try that + # empty credential instead of falling back to the OIDC exchange. + # Provenance is generated automatically for trusted publishes from GitHub + # Actions on public repos, which is why package.json now has `repository`. + run: | + npm config delete //registry.npmjs.org/:_authToken || true + npm publish --access public - name: Create Git tag run: | diff --git a/package.json b/package.json index 6fe2e2b..1efd2e2 100644 --- a/package.json +++ b/package.json @@ -25,6 +25,10 @@ ], "author": "", "license": "MIT", + "repository": { + "type": "git", + "url": "git+https://github.com/comet-ml/ccsync.git" + }, "dependencies": { "axios": "^1.6.0", "chokidar": "^4.0.3",