Repository navigation
ci(release): switch to npm trusted publisher (OIDC) — no NPM_TOKEN - #35
Merged
Merged
Conversation
…nfig
- Upgrade @semantic-release/npm 12.0.2 → 13.2.0: adds native OIDC
trusted-publishing support and replaces the npm whoami auth check
with npm publish --dry-run output parsing. Fixes the EINVALIDNPMTOKEN
failure in the dry-run step when no NPM_TOKEN is configured.
- Pin the job to the GitHub Actions environment
'npmjs:@ui5/webcomponents-geomap' — npmjs.com's trusted-publisher
config requires the OIDC claim's environment to match.
- Drop registry-url from setup-node: without a token, the .npmrc
template referencing ${NODE_AUTH_TOKEN} is not needed and only risks
interfering with the OIDC exchange.
- Drop NPM_AUTH_TOKEN env entries and refresh the explanatory comment
on the Release step.
Repo-side prerequisite: a GitHub Environment named
'npmjs:@ui5/webcomponents-geomap' must exist on the repo (optionally
with deployment-branch restriction to main/next).
miloshevb
approved these changes
Oct 16, 2026
|
🎉 This PR is included in version 0.1.0 🎉 The release is available on npm and GitHub releases. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The release workflow's Verify auth (dry-run only) step was failing with
EINVALIDNPMTOKEN— see run 38875275562. Root cause:@semantic-release/npm@12.0.2runsnpm whoamiinverifyConditions, which requires a long-lived token identity and cannot be satisfied by OIDC trusted publishing.Additionally, the release colleagues flagged that our npmjs.com trusted-publisher config is pinned to a specific GitHub Actions environment — which this workflow was not declaring, so even a correct OIDC token would be rejected.
What changed
@semantic-release/npm12.0.2 → 13.2.0 (package.json+package-lock.json).npm whoamiauth probe withnpm publish --dry-runoutput parsing, which works natively with trusted publishing. NoNPM_TOKENneeded.environment: 'npmjs:@ui5/webcomponents-geomap'at thereleasejob level.environmentclaim must match or npm rejects the publish.registry-urlfromsetup-node..npmrctemplate referencing${NODE_AUTH_TOKEN}. With no token in play, it's dead weight — and the empty resolution is one of the known interference modes for OIDC auth (Using OIDC Trusted Publishing but getting ENONPMTOKEN No npm token specified semantic-release/npm#1069).NPM_AUTH_TOKEN: ""env entries on both the dry-run and real-release steps and refresh the comment to describe the new OIDC-native flow.Repo-side prerequisite⚠️
A GitHub Environment named exactly
npmjs:@ui5/webcomponents-geomapmust exist on this repo:npmjs:@ui5/webcomponents-geomap.mainandnext— matches theinputs.branchchoices.Without that environment the workflow run will fail to start the
releasejob (GHA refuses theenvironment:reference).Verification
After merge + environment creation, re-run the workflow with
dry_run: true:Verify auth (dry-run only)should pass (noEINVALIDNPMTOKEN).References