From 3e048c92068ce6d06bddeca392c11d8cc98808ee Mon Sep 17 00:00:00 2001 From: Maycon Mello Date: Thu, 24 Sep 2026 10:19:29 -0300 Subject: [PATCH 1/4] ci: switch npm publish to trusted publishing (OIDC) --- .github/workflows/npm-publish.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 0f70c13f5..057fc4792 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -4,16 +4,19 @@ on: release: types: [published] +permissions: + id-token: write # OIDC token for npm trusted publishing + contents: read + jobs: build-and-publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v1 + - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: "22.x" registry-url: https://registry.npmjs.org/ + - run: npm install -g npm@latest # trusted publishing needs npm >= 11.5.1 - run: yarn install --frozen-lockfile --ignore-scripts - run: yarn changeset publish - env: - NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} From 246b092d0494dae2780592d033a116c870565367 Mon Sep 17 00:00:00 2001 From: Maycon Mello Date: Thu, 24 Sep 2026 10:21:32 -0300 Subject: [PATCH 2/4] npm trusted publishing --- .github/workflows/npm-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 057fc4792..536341b93 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -5,7 +5,7 @@ on: types: [published] permissions: - id-token: write # OIDC token for npm trusted publishing + id-token: write contents: read jobs: @@ -17,6 +17,6 @@ jobs: with: node-version: "22.x" registry-url: https://registry.npmjs.org/ - - run: npm install -g npm@latest # trusted publishing needs npm >= 11.5.1 + - run: npm install -g npm@latest - run: yarn install --frozen-lockfile --ignore-scripts - run: yarn changeset publish From cb5a0d6fe489116d98d7be54ff6942f37a0a6a60 Mon Sep 17 00:00:00 2001 From: Maycon Mello Date: Thu, 24 Sep 2026 16:26:37 -0300 Subject: [PATCH 3/4] ci: document how npm trusted publishing works in publish workflow --- .github/workflows/npm-publish.yml | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 536341b93..6780811cc 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -1,3 +1,21 @@ +# Publishes packages to npm using npm Trusted Publishing (OIDC). +# Docs: https://docs.npmjs.com/trusted-publishers +# +# How authentication works (no NPM_TOKEN secret is used): +# 1. GitHub gives this job a short-lived, signed OIDC token that says +# "I am workflow npm-publish.yml in repo docknetwork/sdk". +# 2. `npm publish` (npm >= 11.5.1) detects GitHub Actions and sends that +# token to the npm registry. +# 3. npm checks it against the Trusted Publisher configured on each package +# (npmjs.com > package > Settings > Trusted Publisher) and, if it matches, +# returns a temporary publish token valid only for that package. +# 4. npm also attaches a provenance attestation linking the release to this +# commit and workflow run. +# +# Every published package must have a Trusted Publisher configured on npmjs.com +# with: owner `docknetwork`, repository `sdk`, workflow `npm-publish.yml`. +# Renaming this file breaks publishing until those settings are updated. + name: npm Publish on: @@ -5,18 +23,21 @@ on: types: [published] permissions: - id-token: write + id-token: write # lets the job request the OIDC token npm exchanges for a publish token contents: read jobs: build-and-publish: - runs-on: ubuntu-latest + runs-on: ubuntu-latest # trusted publishing only works on GitHub-hosted runners steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: "22.x" registry-url: https://registry.npmjs.org/ + # Node 22 ships npm 10; trusted publishing needs npm >= 11.5.1. - run: npm install -g npm@latest - run: yarn install --frozen-lockfile --ignore-scripts + # Changesets runs `npm publish` for each package with a new version. + # No NODE_AUTH_TOKEN needed: npm authenticates via OIDC (see top of file). - run: yarn changeset publish From 4678736b4d0fccb014d61357084042ff520412af Mon Sep 17 00:00:00 2001 From: Maycon Mello Date: Fri, 25 Sep 2026 14:08:51 -0300 Subject: [PATCH 4/4] ci: run npm publish in protected npm-publish environment --- .github/workflows/npm-publish.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 6780811cc..dd7480890 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -13,8 +13,14 @@ # commit and workflow run. # # Every published package must have a Trusted Publisher configured on npmjs.com -# with: owner `docknetwork`, repository `sdk`, workflow `npm-publish.yml`. -# Renaming this file breaks publishing until those settings are updated. +# with: owner `docknetwork`, repository `sdk`, workflow `npm-publish.yml`, +# environment `npm-publish`. Renaming this file or the environment breaks +# publishing until those settings are updated. +# +# Why the environment matters: npm only accepts tokens from jobs that ran in the +# `npm-publish` environment. GitHub enforces that environment's rules (required +# reviewer approval, allowed branches/tags) in repo settings, so editing this +# file on a branch cannot skip them. name: npm Publish @@ -29,6 +35,8 @@ permissions: jobs: build-and-publish: runs-on: ubuntu-latest # trusted publishing only works on GitHub-hosted runners + # Requires reviewer approval before the job starts (Settings > Environments). + environment: npm-publish steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4