Publish to npm via OIDC trusted publishing - #2481
Merged
Merged
Conversation
The NPM_TOKEN secret is a 90-day granular token expiring ~2026-11-23, tracked by #2452. Trusted publishing removes the stored credential entirely, ending the renewal cycle and adding provenance attestations. Includes a patch changeset so the new publish path is exercised while the existing token is still valid as a fallback.
🦋 Changeset detectedLatest commit: 1d367b1 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
✅ Deploy Preview for cloudfour-patterns ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
The
NPM_TOKENsecret is a 90-day npm granular token created 2026-08-25 that expires around 2026-11-23 — #2452 exists to renew it. npm capped granular write tokens at 90 days after revoking classic tokens entirely, so that renewal is now a permanent recurring chore. This switches to OIDC trusted publishing, which removes the stored credential and ends the cycle.The change is small because
changeset publishshells out tonpm publish, which detects OIDC on its own: we addid-token: writeand dropNODE_AUTH_TOKEN.registry-urlwas already set (required — OIDC silently fails without it),access: publicis already in the changeset config, andrepositorymatches the GitHub repo as provenance requires. The same migration was just completed oncloudfour/lighthouse-parade, which published successfully with provenance.This includes a patch changeset, deliberately. Trusted publishing can only be verified by an actual publish, and this package releases roughly quarterly — waiting for a natural release risks reaching the token's November expiry still unverified. Releasing now exercises the new path while the existing token remains valid as a fallback. There is a live npm CLI bug (npm/cli#8976) where scoped packages 404 under OIDC, but the reported cases are workspace monorepos publishing many packages; this repo publishes a single package with no workspaces. Verifying now rather than in November is the point.
Note this references #2452 without a closing keyword, so merging won't auto-close it. The renewal reminder should stay open until a publish has actually succeeded without a token — if OIDC turns out not to work here, that reminder is the safety net.
Screenshots
Testing
Publishing can only be exercised from
main, so most of this is post-merge verification.@cloudfour/patterns→ Settings lists a trusted publisher for repositorycloudfour/cloudfour.com-patternsand workflowchangesets.yml(note: notrelease.yml— this repo's workflow has a different filename)mainafter that second merge — it should finish greennpm view @cloudfour/patterns version— it should report17.2.1If the publish fails with
E404, the token fallback is still available: revert this PR and the existingNPM_TOKENwill publish as before.