deploy via NPM Trusted Publishing

[jpage4500]

Hi,

I was in the process of switching from a classic token to granular token and noticed text about using Trusted Publishing instead.

There are security risks with this option. For automation or CI/CD uses, please use Trusted Publishing instead.

Is this something that can be used with jdeploy? I'm publishing to npm automatically with a github action like this:

      - name: set NPM token
        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc

      - name: Install and run jdeploy
        run: |
          npm install jdeploy
          npx jdeploy publish

here's the guide I was looking at: https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow

[shannah]

While I have not tried it myself using OIDC, I would expect it to work.

In their github example they had:

permissions:
  id-token: write  # Required for OIDC

Try just doing that, instead of your "Set NPM token" step, and see if it works.