From 4040f58c6e1f9eca1cf544dbd3a2b549978f88ff Mon Sep 17 00:00:00 2001 From: Shane Waid Date: Tue, 11 Aug 2026 05:26:55 -0400 Subject: [PATCH] chore(ci): migrate npm publish to trusted publishing (OIDC) npm revoked classic automation tokens and removed the 2FA-exempt token path, so the NPM_TOKEN this workflow authenticated with is dead. Auth now comes from npm Trusted Publishing: the job's OIDC token is exchanged for short-lived publish credentials, matched against the trusted publisher configured on npmjs.com (this repo + publish.yml). - drop NODE_AUTH_TOKEN / NPM_TOKEN entirely - node 20 -> 22 and npm upgraded to >= 11.5.1 (trusted-publishing minimums) - drop the explicit --provenance flag: attestation is automatic on OIDC publishes from a public repo Requires one-time npmjs.com setup before the next release (package Settings -> Trusted Publisher -> GitHub Actions: CapitolTrace / congress-api / publish.yml), then the NPM_TOKEN repo secret can be deleted. Co-Authored-By: Claude Fable 5 --- .github/workflows/publish.yml | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 55dd596..ea0e4e8 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,11 +1,17 @@ name: Publish to npm -# Publishes when a GitHub release is created. Requires the NPM_TOKEN -# repository secret (an npm automation token for the @capitoltrace scope). +# Publishes when a GitHub release is created, authenticated via npm Trusted +# Publishing (OIDC) — there is no NPM_TOKEN secret anymore. npm revoked +# classic automation tokens and no longer offers a 2FA-exempt token path, so +# the trusted publisher configured on npmjs.com (package Settings → Trusted +# Publisher → GitHub Actions: CapitolTrace/congress-api, publish.yml) is the +# only credential this workflow needs; the job mints a short-lived OIDC token +# per run. # -# Hardened 2026-08-08 to match govwatch's publish workflow (capitoltrace -# automation review): semver-tag gate so marker tags can never publish, and -# npm provenance attestation via OIDC (repo is public, so --provenance works). +# Provenance attestation is generated automatically on OIDC publishes from a +# public repo — no --provenance flag needed. +# +# Semver-tag gate retained: marker tags like v1 can never publish. on: release: types: [published] @@ -17,16 +23,17 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - id-token: write + id-token: write # OIDC — used for both auth (trusted publishing) and provenance steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: - node-version: 20 + # Trusted publishing requires Node >= 22.14. + node-version: 22 cache: npm registry-url: https://registry.npmjs.org + # Trusted publishing requires npm >= 11.5.1; Node 22 bundles npm 10. + - run: npm install -g npm@latest - run: npm ci # prepublishOnly runs typecheck + test + build - - run: npm publish --provenance - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + - run: npm publish