feat(ci): migrate to npm granular tokens and enable provenance#107
Merged
feat(ci): migrate to npm granular tokens and enable provenance#107
Conversation
npm classic tokens were revoked (Dec 2025). This updates the release workflow to support granular access tokens and enables npm provenance attestation via OIDC for supply chain security. - Add id-token: write permission for OIDC provenance signing - Enable NPM_CONFIG_PROVENANCE in release step - Enable provenance in @semantic-release/npm plugin config - NPM_TOKEN secret must now be a granular access token (not classic) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
aromanoEco
requested review from
carlosfebres,
dirkpage,
eliobricenov and
fernandofcampos
as code owners
provenance is not a valid @semantic-release/npm plugin option. The correct location is publishConfig in package.json, which npm reads directly during publish. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
id-token: writepermission andNPM_CONFIG_PROVENANCE: trueto the release workflowprovenance: truein the@semantic-release/npmplugin configRequired action
NPM_TOKENGitHub Actions secret must be rotated to a granular access token (created vianpm token createor npmjs.com). Classic tokens no longer work.Test plan
NPM_TOKENsecret to a granular access token on npmjs.com (with publish scope for@eco-foundation/chains)🤖 Generated with Claude Code