@@ -52,43 +52,24 @@ jobs:
5252 # Configure npm for OIDC authentication with trusted publishing
5353 # This must be done after CI setup to ensure npm is properly configured
5454
55+ # setup-node@v4 with registry-url automatically configures OIDC when id-token: write is set
5556 - name : Setup Node.js for npm publishing
5657 uses : actions/setup-node@v4
5758 with :
58- node-version : ' 22 '
59+ node-version : ' 24 '
5960 registry-url : ' https://registry.npmjs.org'
6061
61- - name : Configure npm for OIDC
62- run : |
63- # Ensure npm is configured to use the correct registry
64- npm config set registry https://registry.npmjs.org/
65- # Remove any existing auth token configuration that might interfere with OIDC
66- npm config delete //registry.npmjs.org/:_authToken || true
67- # Remove any user-level .npmrc that might have tokens
68- if [ -f "$HOME/.npmrc" ]; then
69- # Backup and clean .npmrc, keeping only non-auth config
70- sed -i.bak '/_authToken/d' "$HOME/.npmrc" || true
71- sed -i.bak '/_auth=/d' "$HOME/.npmrc" || true
72- fi
73- # Verify configuration
74- echo "Registry: $(npm config get registry)"
75- echo "npm OIDC will be used automatically during publish"
76- # Show npm config (without sensitive data)
77- npm config list
78-
7962 - name : Building packages
8063 run : yarn build
8164
82- - name : Ensure .npmrc is configured for OIDC before changesets
65+ - name : Verify npm OIDC configuration
8366 run : |
84- # Create/update .npmrc to ensure OIDC is used
85- # setup-node should have already configured this, but we ensure it's correct
86- if [ -f "$HOME/.npmrc" ]; then
87- echo "Current .npmrc content:"
88- cat "$HOME/.npmrc" | grep -v "authToken" | grep -v "_auth" || true
89- fi
90- # Ensure registry is set
91- npm config set registry https://registry.npmjs.org/
67+ # Verify registry is set correctly
68+ echo "Registry: $(npm config get registry)"
69+ # Ensure no token-based auth is configured (OIDC should be used automatically)
70+ npm config delete //registry.npmjs.org/:_authToken || true
71+ # Verify npm can access the registry (this will use OIDC if configured)
72+ echo "npm OIDC authentication configured via setup-node action"
9273
9374name : Create Release Pull Request or Publish to npm
9475 id : changesets
10182 GITHUB_TOKEN : ${{ steps.generate_github_token.outputs.token }}
10283 # Ensure npm uses OIDC authentication
10384 NPM_CONFIG_REGISTRY : ' https://registry.npmjs.org'
85+ NPM_TOKEN : ${{ secrets.NPM_TOKEN }}
10486
10587 - name : Dispatch repository event
10688 if : steps.changesets.outputs.published == 'true'
0 commit comments