krisl / graferse / 34873145982

94%

push

github

ci: publish over OIDC instead of a long lived token

Trusted publishing has GitHub vouch for the workflow identity and npm check
it, so no npm token sits in repository secrets waiting to be leaked or
rotated.  Provenance attestations come for free.

Needs npm >= 11.5.1, hence node 24 and the explicit npm upgrade: a runner
image that quietly drops below the floor reports only ENEEDAUTH.  Dropped
the dependency cache from the release build, and the explicit build step,
which prepack now covers.

DO NOT MERGE THIS BEFORE npmjs.com has a trusted publisher configured for
the package, matching this workflow's filename, the repository owner and the
repository name.  Until then it replaces a working token flow with one that
cannot authenticate.

228 of 254 branches covered (89.76%)

Branch coverage included in aggregate %.

324 of 340 relevant lines covered (95.29%)

657.65 hits per line