From e568f3a13e3fdc869f91b2429d84716d59017900 Mon Sep 17 00:00:00 2001 From: Nathan Drezner Date: Wed, 15 Jul 2026 13:13:53 -0400 Subject: [PATCH] Switch npm publish to trusted publishing (OIDC) Replaces the long-lived NPM_TOKEN with GitHub OIDC-based trusted publishing, matching how pypi-publish.yml already authenticates to PyPI. This removes the expiring-credential failure mode: the npm publish had been failing since v35.2.0 because the stored NPM_TOKEN was no longer accepted by the registry (404 on PUT). - Drop NODE_AUTH_TOKEN / secrets.NPM_TOKEN from the publish step - Drop the explicit --provenance flag (provenance is automatic with trusted publishing) - Add an npm upgrade step, since trusted publishing OIDC requires npm >= 11.5.1 (newer than the version bundled with Node 20) Requires a one-time trusted publisher configuration on npmjs.com for the dash-ag-grid package (repo plotly/dash-ag-grid, workflow npm-publish.yml, environment npm). --- .github/workflows/npm-publish.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 89ef561a..e09042a3 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -26,17 +26,22 @@ jobs: with: node-version: '20.x' registry-url: 'https://registry.npmjs.org' + - name: Upgrade npm for trusted publishing + # Trusted publishing (OIDC) requires npm >= 11.5.1, newer than the + # version bundled with Node 20. + run: npm install -g npm@latest + shell: bash - name: Download npm package uses: actions/download-artifact@v4 with: name: npm-package path: npm-dist/ - name: Publish to npm + # Authenticates via GitHub OIDC using the trusted publisher configured + # on npmjs.com — no NPM_TOKEN needed. Provenance is generated automatically. run: | pushd npm-dist FILE=$(echo *.tgz) - npm publish "$FILE" --provenance --access public + npm publish "$FILE" --access public popd - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} shell: bash