Skip to content

ci: switch to npm trusted publishing#5126

Merged
traefiker merged 2 commits intotraefik:masterfrom
mmatur:feat/trusted-publishing
Apr 1, 2026
Merged

ci: switch to npm trusted publishing#5126
traefiker merged 2 commits intotraefik:masterfrom
mmatur:feat/trusted-publishing

Conversation

@mmatur
Copy link
Copy Markdown
Member

@mmatur mmatur commented Mar 30, 2026

Description

  • Replace npm token-based authentication with OIDC trusted publishing for the release workflow
  • Add id-token: write permission to enable GitHub Actions OIDC token generation
  • Enable provenance attestation on published packages via @semantic-release/npm
  • Remove NPM_TOKEN secret dependency

Motivation

Following npm trusted publishing guidelines, this removes the need for a long-lived npm token, eliminating leakage risk and the need to rotate
it every 3 months.

@mmatur mmatur added status/2-needs-review kind/bug/fix a bug fix area/infrastructure Pull requests that update infra/dependencies labels Mar 30, 2026
@traefiker traefiker merged commit fbab6f9 into traefik:master Apr 1, 2026
4 checks passed
@mmatur mmatur deleted the feat/trusted-publishing branch April 1, 2026 12:14
@traefik traefik deleted a comment from github-actions bot Apr 1, 2026
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 1, 2026

🎉 This PR is included in version 12.0.12 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/infrastructure Pull requests that update infra/dependencies kind/bug/fix a bug fix released

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants