Migrate to OIDC on publishing npm packages in GitHub Actions
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Start with the unchecked workflow files listed in the issue, especially nodejs/node-core-test and nodejs/caritat, and compare them with the checked migrations. Verify the npm trusted-publisher requirements and existing workflow permissions first. Done means the remaining npm publishing workflows no longer use NPM_TOKEN and have the required OIDC configuration.
Written by the indexing model from the issue text.
Description
See https://docs.npmjs.com/trusted-publishers for documentations.
[!note]
Trusted publishing requires npm CLI version 11.5.1 or later.
TL;DR: add the following section in the workflow file to replace ${secrets.NPM_TOKEN}, and create OICD connection on https://www.npmjs.com/package/<package-name>/access:
permissions:
id-token: write # Required for OIDC
contents: read
This should help us get rid of npm tokens in GitHub Actions for publishing packages.
Quick search on npm token usages: https://github.com/search?q=org%3Anodejs+path%3A%22.github%2Fworkflows%22+%22npm+publish%22&type=code
- Dominant language
- JavaScript
- Stars
- 202
- Forks
- 183
- Avg merge
- 13d 12h
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nodejs/admin
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
tsc-agenda
Difficulty 5/5 Over a week Newbie friendliness 30/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
Issue-Bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
sugarlabs/musicblocks#8924 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
ArduPilot/ardupilot_wiki#8088 ·
-
[BUG] createTool tools cannot be registered with Mastra when exactOptionalPropertyTypes is enabled Opencustomer-eng status: needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 84/100