Publish npm releases with trusted publishing and least privilege

[emoriwan]

Context

.github/workflows/release.yml currently supplies the long-lived NPM_DEPLOY_TOKEN to both npm publish and the separate npm dist-tag add promotion path. npm trusted publishing can remove the publish credential by using GitHub Actions OIDC, while dist-tag promotion still needs a narrowly scoped token. This supply-chain hardening should be completed before Leia 2.0 releases.

Outcome

Stable and prerelease packages publish from the authorized Leia release workflow through npm trusted publishing, with explicit least-privilege GitHub permissions and no long-lived token exposed to the publish step. Edge-to-latest promotion retains only the minimum separate credential it still requires.

Scope

• Configure npm trusted publishing for the exact lando/leia repository and release workflow
• Grant id-token: write and the minimum required contents permission to the publishing job
• Ensure the publishing environment uses npm CLI 11.5.1 or newer
• Remove NPM_DEPLOY_TOKEN from stable and prerelease npm publish steps
• Retain or replace the dist-tag promotion credential with a granular token limited to the package and operation it needs
• Preserve dry-run package validation and existing stable, edge, and promotion semantics
• Document the required external npm trusted-publisher and token configuration

Out of scope

• Redesigning the release channel or removing edge-to-latest promotion
• Migrating unrelated repository secrets

Acceptance criteria

• The npm package trusts the exact lando/leia GitHub repository and release workflow as its publisher
• The publish job declares id-token: write and only the GitHub contents permission it requires
• The workflow installs or verifies npm CLI 11.5.1 or newer before publishing
• Stable and prerelease npm publish commands succeed through OIDC without NPM_DEPLOY_TOKEN
• The dist-tag promotion path uses only a separately documented granular credential because trusted publishing does not authorize npm dist-tag add
• Dry-run package validation and stable/latest, prerelease/edge, and edge-to-latest promotion behavior are preserved
• The completion evidence records the external npm configuration and a verified release or safely equivalent workflow validation

Delivery and verification

Open a linked draft completion pull request containing the least-privilege workflow change and documentation for external npm configuration. Validate workflow syntax and package dry-run behavior without publishing from an agent host. Before marking it ready, provide either an actual authorized release run or a safe equivalent demonstrating the OIDC publish path, granular dist-tag promotion path, and preserved stable/prerelease semantics.

Constraints and approvals

Changing npm trusted-publisher settings, package tokens, or performing a release requires separate maintainer authorization and must not be inferred from this task.

Task metadata

schema: tanaab/task-metadata/v2
mode: fallback
fallback:
  work-size: 5
  complexity: medium
  impact: high

[emoriwan]

I've got the assignment and I'm starting.

[emoriwan]

Leia’s release workflow currently exposes the same long-lived npm credential to both package publication and edge-to-latest promotion. I’m going to move stable and prerelease publishes to npm trusted publishing with job-scoped OIDC and read-only contents access, pin a supported npm CLI, isolate promotion behind a package-scoped granular secret, preserve dry-run/channel behavior, and document the required npm-side setup and verification boundary.

[emoriwan]

Pull request opened

• Pull request: Publish npm releases with trusted publishing and least privilege #79
• Conversation: Comments on this issue and its delivery pull request now continue in the same private work session.
• Replies: Each response is posted back to the issue or pull request where its comment originated.