ci: publish npm via OIDC trusted publishing (drop NPM_TOKEN) - #162
Merged
Conversation
Switch the release's npm publish from a long-lived NPM_TOKEN to OIDC trusted publishing: bump actions/setup-node to v7 (OIDC-aware), upgrade npm to >= 11.5.1 in the job, and drop NODE_AUTH_TOKEN. The workflow's existing id-token: write is the auth. Requires a trusted publisher configured per package on npmjs.com. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
joshdholtz
requested review from
alfondotnet and
fire-at-will
and
a lite review from Copilot
August 27, 2026 13:41
Member
Author
|
bugbot run |
@latest would pull a same-day npm into the release pipeline, the exact thing our dependency cooldown guards against (11.19.1 is 1 day old). 11.19.0 is ~a month old and past the 3-day cooldown. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Member
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c8e7ae8. Configure here.
- Trusted publishing needs Node >= 22.14.0 (and npm 12 dropped Node 20), so bump the release job to Node 22. npm stays pinned at 11.19.0. - Correct the npm package repository/homepage URLs from the nonexistent RevenueCat/revenuecat-cli to RevenueCat/cli, which also matters for provenance verification. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fire-at-will
approved these changes
Aug 27, 2026
…UTING Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the release's npm publish off a long-lived
NPM_TOKENand onto OIDC trusted publishing, so there's no npm token to manage or leak.actions/setup-nodeto v7 (OIDC-aware).NODE_AUTH_TOKEN; auth is the workflow's existingid-token: write.Requires before the next release: a trusted publisher configured for each of the 7 packages on npmjs.com (Settings -> Trusted Publisher -> GitHub Actions), pointing at
RevenueCat/cli, workflowrelease.yml. Until every package is configured, its publish step fails.Provenance still works (also OIDC-based). The
NPM_TOKENsecret can be deleted once this is confirmed on a real release.Note
Medium Risk
Release publishing behavior changes and will fail until each npm package has a trusted publisher configured for this repo and workflow; otherwise releases are blocked.
Overview
Release CI now publishes
@revenuecat/cliand platform packages using npm OIDC trusted publishing instead of a long-livedNPM_TOKEN.The release job bumps
actions/setup-nodeto v7, uses Node 22, and installs npm 11.19.0 so trusted publishing meets npm’s minimum version. The publish step no longer setsNODE_AUTH_TOKEN; auth relies on the workflow’s existingid-token: writepermission.scripts/package-npm.mjscomments are updated to describe CI OIDC auth.Docs and npm metadata point at
RevenueCat/cli(replacingRevenueCat/revenuecat-cli) in CHANGELOG, CONTRIBUTING, the npm launcher README/error text, generatedpackage.jsonfields, andpackage-npm.mjshomepage/repository URLs.Reviewed by Cursor Bugbot for commit eb62ee0. Bugbot is set up for automated code reviews on this repo. Configure here.