From 83b4605ab29e9ae9431ec2adef84ce2400ea7048 Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Sun, 16 Aug 2026 16:43:53 +0200 Subject: [PATCH] ci: authenticate the first publish with the token, after all MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The OIDC change one PR ago was the right destination in the wrong order: a trusted publisher is configured on a PACKAGE, and this package does not exist yet. With the token wiring gone and OIDC not yet possible, a tag push would have failed to authenticate by either route. The bootstrap release therefore uses NPM_TOKEN (now set on this repo). Once the package exists, the trusted publisher is configured, this env block goes away again, and the token is revoked. Provenance is unaffected — `id-token: write` is what npm needs to attest the build, independent of how the publish authenticates. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c63e70c..bd0f44e 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -38,7 +38,14 @@ jobs: exit 1 fi - # No token: id-token above lets the CLI exchange a short-lived OIDC - # credential with npm. Provenance is generated automatically for a public - # package from a public repo, so --provenance is not needed either. + # Bootstrap auth. Trusted publishing (OIDC) is the destination and needs no + # token, but it is configured on a PACKAGE — which cannot exist until it + # has been published once. So the first release authenticates with a token; + # once the package exists, the trusted publisher is configured, this env + # block is deleted, and the token is revoked. + # + # Provenance still works here: `id-token: write` above is what npm needs to + # attest the build, and that is independent of how the publish authenticates. - run: npm publish + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}