Switch npm publish to trusted publishing (OIDC)#476
Merged
Conversation
Replaces the long-lived NPM_TOKEN with GitHub OIDC-based trusted publishing, matching how pypi-publish.yml already authenticates to PyPI. This removes the expiring-credential failure mode: the npm publish had been failing since v35.2.0 because the stored NPM_TOKEN was no longer accepted by the registry (404 on PUT). - Drop NODE_AUTH_TOKEN / secrets.NPM_TOKEN from the publish step - Drop the explicit --provenance flag (provenance is automatic with trusted publishing) - Add an npm upgrade step, since trusted publishing OIDC requires npm >= 11.5.1 (newer than the version bundled with Node 20) Requires a one-time trusted publisher configuration on npmjs.com for the dash-ag-grid package (repo plotly/dash-ag-grid, workflow npm-publish.yml, environment npm).
ndrezn
force-pushed
the
npm-trusted-publishing
branch
from
July 15, 2026 17:15
4dbd129 to
e568f3a
Compare
|
BSd3v
added a commit
to BSd3v/dash-ag-grid-real
that referenced
this pull request
Jul 16, 2026
Switch npm publish to trusted publishing (OIDC) (cherry picked from commit 566f2f9)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Rather than rotate a credential that will expire again, this switches to trusted publishing via GitHub OIDC — the same approach
pypi-publish.ymlalready uses for PyPI. No long-lived secret to expire or rotate.Changes
NODE_AUTH_TOKEN/secrets.NPM_TOKENfrom the publish step (auth now via OIDC)--provenanceflag (provenance is automatic with trusted publishing)id-token: writeandenvironment: name: npmwere already present, so no permission changes are needed.npmjs.com has been updated.