From a8d210b6a28468d9d49b9b8bd25c98514fe68068 Mon Sep 17 00:00:00 2001 From: Riccardo Cipolleschi Date: Wed, 8 Jul 2026 14:44:59 +0200 Subject: [PATCH 1/2] fix(release): enable npm trusted publishing (OIDC) The release workflow failed to publish with an npm E404 because it never performed an OIDC token exchange: the job was missing the 'id-token: write' permission, so no trusted-publishing token was minted and the unauthenticated publish was rejected. - Add id-token: write (OIDC) and contents: write (push commit/tag) permissions - Upgrade npm to latest (trusted publishing requires npm >= 11.5.1) - Drop the obsolete NODE_AUTH_TOKEN env now that we use trusted publishing --- .github/workflows/release.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 4e7d6f3..2875585 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -21,6 +21,11 @@ jobs: publish_template: runs-on: ubuntu-latest environment: npm-publish + permissions: + # Required for npm trusted publishing (OIDC token exchange with the registry) + id-token: write + # Required so the bump commit & tag can be pushed back to the branch + contents: write steps: - name: Safeguard against branch name run: | @@ -35,6 +40,9 @@ jobs: with: node-version: 'lts/*' registry-url: 'https://registry.npmjs.org' + - name: Ensure npm supports trusted publishing + # Trusted publishing (OIDC) requires npm >= 11.5.1 + run: npm install -g npm@latest - name: Determine new template version run: echo "VERSION=$(./scripts/bumpedTemplateVersion.sh ${{ inputs.version }})" >> $GITHUB_ENV - name: Update versions to input one From 4811d26bafbcc92040a9f79a464b5e1222192a8c Mon Sep 17 00:00:00 2001 From: Riccardo Cipolleschi Date: Wed, 8 Jul 2026 14:47:27 +0200 Subject: [PATCH 2/2] Remove redundant npm upgrade step (lts/* already bundles npm >= 11.5.1) --- .github/workflows/release.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 2875585..38d8af4 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -40,9 +40,6 @@ jobs: with: node-version: 'lts/*' registry-url: 'https://registry.npmjs.org' - - name: Ensure npm supports trusted publishing - # Trusted publishing (OIDC) requires npm >= 11.5.1 - run: npm install -g npm@latest - name: Determine new template version run: echo "VERSION=$(./scripts/bumpedTemplateVersion.sh ${{ inputs.version }})" >> $GITHUB_ENV - name: Update versions to input one