optimizely / javascript-sdk / 29914083929

78%

push

github

[FSSDK-12891] Switch npm publishing to OIDC trusted publishing (#1169)

* [FSSDK-12891] Switch npm publishing to OIDC trusted publishing

Replace long-lived NPM_PUBLISH_TOKEN with OIDC trusted publishing
for more secure, tokenless CI publishing to npm.

Workflow changes:
- Add id-token: write permission for OIDC token generation
- Move permissions to workflow level (add packages: write for GHR)
- Add GitHub environment gate (npm) for deployment protection
- Upgrade setup-node to v4 and Node to 22 (npm 11.5.1+ requirement)
- Add npm upgrade step to ensure OIDC support
- Remove NPM_PUBLISH_TOKEN from npm publish step (OIDC replaces it)

publish.sh changes:
- Make NODE_AUTH_TOKEN optional in curl lookup (public packages
  don't need auth for registry reads)
- Add --provenance flag for npm registry publishes (supply-chain
  attestations, not supported by GHR)

GHR publish step is unchanged — still uses GITHUB_TOKEN.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* test: temp version bump for OIDC test (revert before merge)

* fix: use string instead of array for optional curl auth header

* test: switch to rc.1 version for OIDC test

* revert: remove temp version bump

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

1545 of 3013 branches covered (51.28%)

Branch coverage included in aggregate %.

8986 of 10536 relevant lines covered (85.29%)

261.69 hits per line