From dd160e11d2d13be29cbe7216495e22e6f3152174 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jind=C5=99ich=20B=C3=A4r?= <jindrichbar@gmail.com>
Date: Tue, 11 Nov 2025 12:55:24 +0100
Subject: [PATCH] chore(js): use OIDC-based auth for npm publishing

---
 .github/workflows/node-release.yaml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/node-release.yaml b/.github/workflows/node-release.yaml
index f50de583..8bd6438d 100644
--- a/.github/workflows/node-release.yaml
+++ b/.github/workflows/node-release.yaml
@@ -7,7 +7,7 @@ env:
 permissions:
   contents: write
   id-token: write
-'on':
+on:
   workflow_dispatch:
     inputs:
       bump:
@@ -45,6 +45,7 @@ jobs:
             uses: actions/setup-node@v6
             with:
               node-version: 24
+              registry-url: 'https://registry.npmjs.org'
 
           - name: Enable Corepack
             run: |
@@ -83,12 +84,7 @@ jobs:
               yarn copy-version
 
           - name: Publish to npm
-            run: |
-              echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-              npm publish --access public
-            env:
-              GITHUB_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
-              NPM_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_NPM_TOKEN }}
+            run: npm publish --provenance
 
           - name: Commit changes
             id: commit
@@ -98,7 +94,7 @@ jobs:
                 author_email: noreply@apify.com
                 message: "chore(js-release): Update package version [skip ci]"
                 tag: "js-${{ steps.get-new-version.outputs.TARGET_VERSION }}"
-    
+
     changelog:
       name: Generate changelog
       needs: [publish]