ci: migrate npm publish to OIDC Trusted Publishing (drop NPM_TOKEN) #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # npm publish uses OIDC Trusted Publishing — NO long-lived NPM_TOKEN. | |
| # | |
| # One-time setup on npmjs.com (required before the first OIDC publish): | |
| # package `docx2pdf-cli` → Settings → Trusted Publisher → GitHub Actions | |
| # organization/user = DrBaher · repository = docx2pdf-cli | |
| # workflow filename = release.yml · environment = (leave blank) | |
| # | |
| # IMPORTANT: do NOT add `registry-url:` to actions/setup-node. With it, setup-node | |
| # writes a placeholder NODE_AUTH_TOKEN into .npmrc and npm sends *that* instead of | |
| # fetching an OIDC token (the masked ENEEDAUTH/404 that blocked the token publishes). | |
| # Without it, npm >= 11.5.1 performs Trusted Publishing via the id-token below. | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # needed for gh release create | |
| id-token: write # needed for npm provenance OIDC | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - name: ensure npm >= 11.5.1 (OIDC support) | |
| run: npm install -g npm@latest && npm --version | |
| - name: Install LibreOffice (for smoke test) | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends libreoffice | |
| - run: npm ci || npm install | |
| - run: npm test | |
| - name: Verify package.json version matches tag | |
| run: | | |
| PKG_VERSION=$(node -p "require('./package.json').version") | |
| TAG_VERSION="${GITHUB_REF_NAME#v}" | |
| if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then | |
| echo "Version mismatch: package.json=$PKG_VERSION, tag=$TAG_VERSION" >&2 | |
| exit 1 | |
| fi | |
| - name: Publish to npm with provenance | |
| run: npm publish --access public --provenance | |
| # No NODE_AUTH_TOKEN — npm mints a short-lived OIDC token via id-token:write. | |
| - name: Create GitHub release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| # Body: pull the section from CHANGELOG.md for this version, fall back to autogen. | |
| if [ -f CHANGELOG.md ]; then | |
| awk -v v="${GITHUB_REF_NAME#v}" ' | |
| /^## \[/ { | |
| if (matched) exit | |
| if (index($0, "[" v "]")) { matched=1; next } | |
| } | |
| matched { print } | |
| ' CHANGELOG.md > /tmp/release-notes.md | |
| fi | |
| if [ ! -s /tmp/release-notes.md ]; then | |
| gh release create "$GITHUB_REF_NAME" --generate-notes --title "$GITHUB_REF_NAME" | |
| else | |
| gh release create "$GITHUB_REF_NAME" --notes-file /tmp/release-notes.md --title "$GITHUB_REF_NAME" | |
| fi |