Migrate the npm packages publication to trusted publishing

Open
  • Is something wrong?
#3,654 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
github-actions, yaml
Domain
ci-cd, release

Research direction

Start by locating the publish-npm-package action and the pre-release, release, manual-publish-npm, and ci workflows. Update publication to use GitHub Actions OIDC with id-token: write and the required npm CLI version, then verify dry runs and check how next versions are promoted to latest without a publish token. The issue also calls for configuring each npm package’s trusted publisher and removing the API token secrets after publication works.

Written by the indexing model from the issue text.

Description

CI/CD :factory:

Why

npm deprecates the granular access tokens with direct publish access that bypass 2FA, and publishing new versions directly with such a token will no longer be possible in January 2027, whereas our workflows publish the npm packages with an API token (see https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/ and https://github.com/npm/cli/issues/8547#issuecomment-5918553542).

What

Migrate the publication of the npm packages to trusted publishing from GitHub Actions (OIDC), so that the publication no longer relies on long-lived npm tokens.

How

  • Configure the trusted publisher (repository and workflows) of each npm package on npmjs.com (with "Allow npm dist-tag" ticked) (@jpraynaud)
  • Update the publish-npm-package action to publish with OIDC (id-token: write permission, minimum npm CLI version) instead of the API token
  • Adapt the publication jobs of the pre-release, release, manual-publish-npm and ci (dry run) workflows
  • Check how the promotion of a next version to latest works without a publish token
  • Remove the npm API token secrets once the publication works (@jpraynaud)
Ressources
Dominant language
Rust
Stars
155
Forks
52
Avg merge
2d 17h
Merged PRs (30d)
37

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from IntersectMBO/mithril

All issues in IntersectMBO/mithril

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.