Enables OIDC for NPM package publishing - #61
Conversation
Updates the release workflow to use npm Trusted Publishing (OpenID Connect) for authenticating with the NPM registry. This enhances security by removing the dependency on a long-lived `NPM_TOKEN` secret. The change involves adding `id-token: write` permissions to the workflow and ensuring the latest npm version is installed, which is a prerequisite for Trusted Publishing.
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
33c703a to
4dceb5c
Compare
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
1 similar comment
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
Updates the release workflow to use npm Trusted Publishing (OpenID Connect) for authenticating with the NPM registry. This enhances security by removing the dependency on a long-lived
NPM_TOKENsecret.The change involves adding
id-token: writepermissions to the workflow and ensuring the latest npm version is installed, which is a prerequisite for Trusted Publishing.