Skip to content

Adopt npm trusted publishing in CI #100

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ryantm merged 1 commit into from
Mar 24, 2026
Merged

Adopt npm trusted publishing in CI #100

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 7 additions & 10 deletions .github/workflows/CI.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@ env:
MACOSX_DEPLOYMENT_TARGET: '10.13'

permissions:
contents: write
id-token: write
contents: read
'on':
push:
branches:
Expand Down Expand Up @@ -138,12 +137,16 @@ jobs:
if: github.ref == 'refs/heads/main'
needs:
- test
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- name: Setup node
uses: actions/setup-node@v4
with:
node-version: 20
node-version: 24
registry-url: https://registry.npmjs.org
- name: Install dependencies
run: npm ci
- name: Download all artifacts
Expand All @@ -158,10 +161,4 @@ jobs:
run: ls -R ./npm
shell: bash
- name: Publish
run: |
npm config set provenance true
echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
npm publish --access public
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
run: npm publish --access public
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,4 +38,4 @@ Following ["Publish It" section from `napi-rs` docs](https://napi.rs/docs/introd
2. `npm version [major|minor|patch]`
3. Send that as a Pull Request to GitHub. Ensure that the commit message consisting **only** of `x.y.z` - this is how the CI decides to publish to `npm`!

`NPM_TOKEN` is part of the repo secrets, generated [like this](https://httptoolkit.com/blog/automatic-npm-publish-gha/).
Configure npm trusted publishing for `replit/ruspty` with the workflow filename `CI.yml` before merging a version bump PR. The publish job now uses GitHub OIDC, so `NPM_TOKEN` is no longer required.
Loading