Skip to content

fix(ci): unblock OIDC npm publishing (v0.1.2) #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
splincode merged 3 commits into from
Oct 19, 2026
Merged

fix(ci): unblock OIDC npm publishing (v0.1.2) #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
784cc79
fix(ci): let npm use OIDC instead of empty setup-node auth token
splincode Oct 19, 2026
80f77fe
chore: prepare v0.1.2 for OIDC validation
splincode Oct 19, 2026
99e67d8
docs: use v0.1.2 in OIDC release example
splincode Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,6 @@ jobs:
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: "24"
registry-url: https://registry.npmjs.org
package-manager-cache: false

- name: Require OIDC-compatible npm
Expand All @@ -103,7 +102,21 @@ jobs:
}
'

# OIDC requires no authentication token in npm config. Supplying
# registry-url to setup-node writes a classic _authToken placeholder,
# which can prevent npm from starting its OIDC exchange.
- name: Verify OIDC credentials are available
shell: bash
run: |
set -euo pipefail
test -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}"
test -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}"
if [[ -n "${NODE_AUTH_TOKEN:-}" || -n "${NPM_TOKEN:-}" ]]; then
echo "Unexpected npm token environment variable; OIDC must be used" >&2
exit 1
fi

# No npm install or dependency scripts in the OIDC-enabled job.
# npm automatically generates provenance for public packages.
- name: Publish to npm via OIDC
run: npm publish --access public --ignore-scripts
run: npm publish --access public --ignore-scripts --registry=https://registry.npmjs.org/
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,13 +82,13 @@ Keep the version in `package.json` synchronized with the first published version

### Publish the next version

Update `package.json` to an unpublished version (for example, `0.1.1`), merge it to `main`, and confirm CI is green. Then push the corresponding tag **from a commit on main**:
Update `package.json` to an unpublished version (for example, `0.1.2`), merge it to `main`, and confirm CI is green. Then push the corresponding tag **from a commit on main**:

```sh
git switch main
git pull --ff-only
git tag v0.1.1
git push origin v0.1.1
git tag v0.1.2
git push origin v0.1.2
```

The [publish workflow](./.github/workflows/publish.yml) verifies the exact version and that the tag commit is on `main`, runs tests without OIDC permissions, and publishes in a separate approval-gated environment. The publisher job disables npm lifecycle scripts and uses npm's short-lived OIDC authentication and automatic provenance. Pinned GitHub Action commit SHAs and disabled release-job caching reduce supply-chain risk.
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "prettier-plugin-angular-comment",
"version": "0.1.1",
"version": "0.1.2",
"description": "Format Angular templates in JS/TS template literals with /* Angular */",
"type": "module",
"exports": {
Expand Down
Loading