ci: use npm trusted publishing (OIDC) instead of token

2026-02-15 14:59:09 -04:00 · 2026-02-15 14:59:09 -04:00 · 53bf2ebf10
commit 53bf2ebf10
parent 73985a2aaa
1 changed files with 2 additions and 3 deletions
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@ -10,6 +10,7 @@ jobs:

    permissions:
      contents: write
+      id-token: write

    steps:
      - uses: actions/checkout@v4
@ -29,9 +30,7 @@ jobs:
          node-version: 22
          registry-url: https://registry.npmjs.org

-      - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm publish --provenance --access public

      - name: Create GitHub Release
        env: