From 028b331ebbddf6ca86f844c5d75323c58be542a5 Mon Sep 17 00:00:00 2001 From: Oleksii Zubko Date: Thu, 20 Aug 2026 14:40:43 +0300 Subject: [PATCH] Prepare the deploy workflow for npm OIDC publish npm trusted publishing needs the workflow to be able to mint an OIDC token, so grant `id-token: write` and narrow the rest of the job to `contents: read`. `cache: npm` is gone from a release build: a restored dependency cache is state carried over from an earlier run, and what gets published should come from a clean install only. `package-manager-cache: false` According to: https://docs.npmjs.com/trusted-publishers Relates-To: MINOR Signed-off-by: Oleksii Zubko --- .github/workflows/deploy.yml | 8 ++++++-- scripts/publish-packages.sh | 2 -- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index ae941a3a..bd4b4ddf 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -17,6 +17,10 @@ on: - write - verify +permissions: + id-token: write # Required for OIDC + contents: read + jobs: deploy-sdk-package-to-npm: name: Typescript SDK Build and Deploy @@ -31,7 +35,8 @@ jobs: uses: actions/setup-node@v7 with: node-version: '24' - cache: npm + registry-url: 'https://registry.npmjs.org' + package-manager-cache: false # never use caching in release builds # MockServer, which backs the functional tests, ships Java 17 bytecode. # The runner defaults to Java 11, so pin the version the jar needs. - name: Use Java @@ -45,4 +50,3 @@ jobs: run: scripts/publish-packages.sh -${PACKAGE_NAME} env: PACKAGE_NAME: ${{ inputs.chooseDeploy }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/scripts/publish-packages.sh b/scripts/publish-packages.sh index 466a4164..cb41b155 100755 --- a/scripts/publish-packages.sh +++ b/scripts/publish-packages.sh @@ -20,8 +20,6 @@ # Simple script that bundles the publishing of packages, # to be run from GitHub Actions -echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > ~/.npmrc - npm ci while [[ $# -gt 0 ]]; do