Skip to content

Commit 2810cf1

Browse files
Christian Zieglerfeigi
Christian Ziegler
authored and
feigi
committed
release: switch npm publish to trusted publishing (OIDC)
NPM_TOKEN creation is blocked by the npm account's 2FA requirement. Trusted publishing removes the need for a stored token entirely: - setup-node@v5 -> @v6 (v5 and earlier write an empty _authToken line to .npmrc when no NODE_AUTH_TOKEN is set, which breaks the OIDC handshake - actions/setup-node#1551) - drop NODE_AUTH_TOKEN/secrets.NPM_TOKEN from the publish step env (id-token: write + --provenance already present, unchanged) - README/ADR 0021: document the one-time bootstrap npm trusted publishing requires - fleet-ctl has never been published, so there is no npmjs.com settings page yet to configure a Trusted Publisher on. Needs one manual `npm publish --access public` (interactive 2FA OTP, not a CI credential) to reserve the name, then adding release.yml as fleet-ctl's Trusted Publisher.
1 parent 9e13b82 commit 2810cf1

3 files changed

Lines changed: 24 additions & 16 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ jobs:
140140
git push origin "$NEXT"
141141
fi
142142
143-
- uses: actions/setup-node@v5
143+
- uses: actions/setup-node@v6
144144
with:
145145
node-version-file: .nvmrc
146146
registry-url: https://registry.npmjs.org
@@ -172,7 +172,6 @@ jobs:
172172
# the old pre-occupancy npm-name-gate could never be.
173173
env:
174174
NEXT: ${{ steps.version.outputs.next }}
175-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
176175
run: |
177176
set -euo pipefail
178177
VER="${NEXT#v}"

‎README.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,12 @@ it to the box you develop on.
3333

3434
`fleet-ctl` is the npm package the fleet publishes on every release —
3535
publishing the name is the collision guard (a squatted name fails the
36-
release). Publishing needs an `NPM_TOKEN` repository secret with publish
37-
rights for `fleet-ctl`; without it the release job fails at its publish
38-
step and the install above answers 404 (ADR 0021, Consequences). Background:
36+
release). Publishing authenticates via [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/)
37+
(OIDC, no stored token): `fleet-ctl` must exist on the registry and have
38+
this repo's `release.yml` configured as its Trusted Publisher before the
39+
first automated release — see ADR 0021, Consequences, for the one-time
40+
bootstrap. Until then the release job fails at its publish step and the
41+
install above answers 404. Background:
3942
[`docs/adr/0006-rename-to-fleet-ctl.md`](docs/adr/0006-rename-to-fleet-ctl.md).
4043

4144
The plugin also ships an omp extension, `member-write-guard`, which refuses a

‎docs/adr/0021-omp-native-install-route-replaces-the-marketplace.md‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -147,17 +147,23 @@ ADR 0020:
147147
- **Version semantics change**: installs track published semver, not the
148148
`main` branch tip; every merged PR still mints a release, and now also
149149
a package version. `marketplace.autoUpdate` is gone with the route.
150-
- **Publishing needs a credential the repo does not hold yet.**
151-
`release.yml`'s publish step authenticates with the `NPM_TOKEN`
152-
repository secret; when this ADR landed the repo had no Actions secrets
153-
and `fleet-ctl` had never been published (`npm view fleet-ctl` → 404,
154-
2026-10-01). Until the operator stores an npm token with publish rights
155-
for `fleet-ctl` as `NPM_TOKEN` (or publishes once by hand and switches
156-
the package to npm trusted publishing from this workflow), every release
157-
run tags and creates the GitHub release, then fails at the publish step,
158-
and `omp plugin install fleet-ctl` keeps answering 404. A re-run after
159-
the secret exists reuses the tag already on the merge commit rather
160-
than minting a new one, so the missed version is the one published.
150+
- **Publishing authenticates via npm trusted publishing (OIDC), not a
151+
stored secret.** `release.yml` requests a short-lived OIDC token
152+
(`permissions: id-token: write`) and runs `npm publish --provenance`;
153+
there is no `NPM_TOKEN` in the repo and none is needed going forward.
154+
This has one bootstrap requirement npm cannot skip: a package with zero
155+
published versions has no npmjs.com settings page, so there is nowhere
156+
to configure a Trusted Publisher yet (`fleet-ctl` had never been
157+
published — `npm view fleet-ctl` → 404, 2026-10-01). The operator must
158+
publish once by hand (`npm publish --access public` from a local
159+
checkout, normal interactive 2FA OTP, not a CI credential) to reserve
160+
the name, then add this repo's `release.yml` as `fleet-ctl`'s Trusted
161+
Publisher on npmjs.com. Until that's done, every release run tags and
162+
creates the GitHub release, then fails at the publish step, and
163+
`omp plugin install fleet-ctl` keeps answering 404. A re-run after the
164+
Trusted Publisher is configured reuses the tag already on the merge
165+
commit rather than minting a new one, so the missed version is the one
166+
published.
161167
- CI retargets: `smoke-omp.sh` links the checkout instead of building a
162168
dev catalog, asserts the three bare commands by the same `--no-tools`
163169
substitution probe (measured live on the link route), and adds the

0 commit comments

Comments
 (0)