From e169d1a7dcc17c1b5432ec8efb340cfb7a3096dc Mon Sep 17 00:00:00 2001 From: Drew Stone Date: Tue, 1 Sep 2026 21:29:20 -0600 Subject: [PATCH] fix(release): configure npm trusted publishing --- .github/workflows/publish.yml | 2 ++ tests/publish-workflow.test.ts | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6645dba..3065a97 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -64,6 +64,8 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.18.0 + registry-url: https://registry.npmjs.org + package-manager-cache: false cache: pnpm - run: pnpm install --frozen-lockfile - name: Verify tag matches package version diff --git a/tests/publish-workflow.test.ts b/tests/publish-workflow.test.ts index 34d54e0..044d06e 100644 --- a/tests/publish-workflow.test.ts +++ b/tests/publish-workflow.test.ts @@ -13,9 +13,10 @@ describe('release runtime contract', () => { it('publishes through npm trusted publishing without a write token', () => { expect(publish).toContain('id-token: write') expect(publish).toContain('node-version: 24.18.0') + expect(publish).toContain('registry-url: https://registry.npmjs.org') + expect(publish).toContain('package-manager-cache: false') expect(publish).toContain('npm publish --access public --ignore-scripts') expect(publish).not.toContain('NODE_AUTH_TOKEN') - expect(publish).not.toContain('registry-url:') expect(publish).not.toContain('pnpm publish') }) })