Skip to content

ci: switch npm publish from NPM_TOKEN to OIDC trusted publishing - #46

Merged
asiazhang merged 1 commit into
mainfrom
ci/oidc-trusted-publishing
May 13, 2026
Merged

ci: switch npm publish from NPM_TOKEN to OIDC trusted publishing#46
asiazhang merged 1 commit into
mainfrom
ci/oidc-trusted-publishing

Conversation

@asiazhang

@asiazhang asiazhang commented May 13, 2026

Copy link
Copy Markdown
Collaborator

变更内容

  • 添加 `id-token: write` 权限，允许 GitHub 签发 OIDC 令牌
  • 移除 `NODE_AUTH_TOKEN` 环境变量（不再需要 NPM Token secret）
  • 添加 `--provenance` 参数，发布时附带供应链来源证明

优势

  • 无需维护 Token：不再有 90 天过期问题
  • 更安全：每次发布使用 5 分钟有效的临时令牌
  • 可验证：`--provenance` 提供包的构建来源证明

后续操作

合并后需在 npmjs.com 配置 Trusted Publisher：

  • Repository owner: `OpenTestSolar`
  • Repository name: `testtool-javascript-playwright`
  • Workflow filename: `npm-publish.yml`
  • Environment: 留空

配置完成后可删除 GitHub Secrets 中的 `NPM_TOKEN`。

pinhenzhang
ci: switch npm publish from NPM_TOKEN to OIDC trusted publishing
7ff3760 
- Add id-token: write permission for OIDC token generation
- Remove NODE_AUTH_TOKEN env variable (no longer needed)
- Add --provenance flag for supply chain transparency
- Eliminates 90-day token rotation burden
@asiazhang
asiazhang requested a review from dzx-cptbtptp as a code owner May 13, 2026 03:07
@asiazhang
asiazhang merged commit 742f306 into main May 13, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dzx-cptbtptp dzx-cptbtptp dzx-cptbtptp approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@asiazhang @dzx-cptbtptp