From 7d903633cc7c32d59b70d49c424b5e7854593c9f Mon Sep 17 00:00:00 2001 From: Robin Andeer Date: Mon, 6 Jul 2026 14:07:25 -0400 Subject: [PATCH] fix: publish via npm OIDC trusted publisher Request id-token for GitHub Actions OIDC, drop NPM_TOKEN auth from publish, and use --provenance so npm accepts the configured trusted publisher. --- .github/workflows/publish.yml | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 76e93d8..c0d3350 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,6 +9,7 @@ on: permissions: contents: read + id-token: write jobs: publish: @@ -26,12 +27,6 @@ jobs: uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 (sdk-node publish) with: node-version: '22' - registry-url: 'https://registry.npmjs.org' - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - - - name: Verify npm auth - run: npm whoami - name: Install dependencies run: bun install --frozen-lockfile @@ -49,9 +44,9 @@ jobs: if echo "$VERSION" | grep -q "-"; then TAG=$(echo "$VERSION" | sed 's/.*-\([a-zA-Z]*\).*/\1/') echo "Publishing @runwayml/avatars prerelease with --tag $TAG" - npm publish --access public --tag "$TAG" + npm publish --access public --provenance --tag "$TAG" else - npm publish --access public + npm publish --access public --provenance fi - name: Publish react @@ -61,7 +56,7 @@ jobs: if echo "$VERSION" | grep -q "-"; then TAG=$(echo "$VERSION" | sed 's/.*-\([a-zA-Z]*\).*/\1/') echo "Publishing @runwayml/avatars-react prerelease with --tag $TAG" - npm publish --access public --tag "$TAG" + npm publish --access public --provenance --tag "$TAG" else - npm publish --access public + npm publish --access public --provenance fi