Skip to content

ci: enable npm trusted publishing#79

Merged
Addono merged 3 commits into
mainfrom
copilot/npm-trusted-publishing
Apr 22, 2026
Merged

ci: enable npm trusted publishing#79
Addono merged 3 commits into
mainfrom
copilot/npm-trusted-publishing

Conversation

@Addono
Copy link
Copy Markdown
Owner

@Addono Addono commented Apr 22, 2026

Summary

  • publish gh-attach publicly on npm and keep the GitHub Packages mirror
  • switch the release workflow from NPM_TOKEN to npm Trusted Publishing via OIDC
  • update release docs/specs for the bootstrap publish and trusted publisher setup

Validation

  • npm run format:check
  • npm run lint
  • npm run typecheck
  • npm test
  • npm run build

Addono and others added 3 commits April 22, 2026 10:39
Keep public npm as gh-attach, publish a scoped GitHub Packages mirror, and wire the release workflow to npm Trusted Publishing via OIDC.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Run the release and validation jobs on a Node/npm combination that npm Trusted Publishing supports, and allow manual release workflow dispatches for future verification.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Make public npm the clear default installation path, note that no npm authentication is required for end users, and frame GitHub Packages as an optional mirror.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Addono Addono merged commit 75251ed into main Apr 22, 2026
11 checks passed
@Addono Addono deleted the copilot/npm-trusted-publishing branch April 22, 2026 09:12
@github-actions
Copy link
Copy Markdown

🎉 This PR is included in version 1.5.8 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant