[PR #8] [MERGED] ci: publish to npm via Trusted Publishing (OIDC), not a stored token #18

New issue

Closed

opened 2026-10-31 22:03:52 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 22:03:52 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/comfy-typescript-sdk/pull/8
Author: @wei-hai
Created: 7/21/2026
Status: ✅ Merged
Merged: 7/21/2026
Merged by: @wei-hai

Base: main ← Head: ci/npm-trusted-publishing

📝 Commits (1)

9d26a18 ci: publish to npm via Trusted Publishing (OIDC), not a stored token

📊 Changes

1 file changed (+14 additions, -12 deletions)

View changed files

📝 .github/workflows/publish.yml (+14 -12)

📄 Description

Switches the npm publish job from token auth to npm Trusted Publishing (OIDC) — no NPM_TOKEN / publish secret is stored in the repo anymore. This matches the Python SDK, which already publishes to PyPI via OIDC.

Changes

Remove NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} from the publish step — auth is now the short-lived OIDC token (the job already declares id-token: write).
Add an npm upgrade step: OIDC trusted publishing requires npm ≥ 11.5.1, and Node 22 still bundles npm 10.x.
Provenance is generated automatically under trusted publishing (--provenance kept explicit).
The npm environment (required-reviewers approval gate) is unchanged and can be pinned in the trusted-publisher config.

One-time maintainer setup (replaces the `NPM_TOKEN` secret)

Configure a Trusted Publisher on npmjs.com for @comfyorg/sdk:

Repository: Comfy-Org/ComfyTypeScriptSDK
Workflow: publish.yml
Environment: npm

No token to mint, store, or rotate.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/comfy-typescript-sdk/pull/8 **Author:** [@wei-hai](https://github.com/wei-hai) **Created:** 7/21/2026 **Status:** ✅ Merged **Merged:** 7/21/2026 **Merged by:** [@wei-hai](https://github.com/wei-hai) **Base:** `main` ← **Head:** `ci/npm-trusted-publishing` --- ### 📝 Commits (1) - [`9d26a18`](https://github.com/Comfy-Org/comfy-typescript-sdk/commit/9d26a18d342d96055891e0b9d0a976f105df6d17) ci: publish to npm via Trusted Publishing (OIDC), not a stored token ### 📊 Changes **1 file changed** (+14 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/publish.yml` (+14 -12) </details> ### 📄 Description Switches the npm publish job from token auth to **npm Trusted Publishing (OIDC)** — no `NPM_TOKEN` / publish secret is stored in the repo anymore. This matches the Python SDK, which already publishes to PyPI via OIDC. ## Changes - Remove `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` from the publish step — auth is now the short-lived OIDC token (the job already declares `id-token: write`). - Add an npm upgrade step: OIDC trusted publishing requires **npm ≥ 11.5.1**, and Node 22 still bundles npm 10.x. - Provenance is generated automatically under trusted publishing (`--provenance` kept explicit). - The `npm` environment (required-reviewers approval gate) is unchanged and can be pinned in the trusted-publisher config. ## One-time maintainer setup (replaces the `NPM_TOKEN` secret) Configure a **Trusted Publisher** on npmjs.com for `@comfyorg/sdk`: - Repository: `Comfy-Org/ComfyTypeScriptSDK` - Workflow: `publish.yml` - Environment: `npm` No token to mint, store, or rotate. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 22:03:52 +00:00