TanTan
fa9c73363d
Dev Build / cleanup (push) Waiting to run
Dev Build / typecheck (push) Waiting to run
Publish MCP to npm / Build, test, and publish MCP (push) Waiting to run
Publish SDK to npm / Build, test, and publish SDK (push) Waiting to run
Sync action catalog to docs / sync (push) Waiting to run
Publish UI to npm / Build and publish UI (push) Waiting to run
Build and Release / preflight (push) Waiting to run
31 lines
1.2 KiB
Markdown
31 lines
1.2 KiB
Markdown
# npm Trusted Publishing
|
|
|
|
The npm publish workflows use GitHub Actions OIDC instead of a long-lived
|
|
`NPM_TOKEN`. Each package must have a matching Trusted Publisher entry on npm
|
|
before its first publish after this migration.
|
|
|
|
For each package (`@snowluma/sdk`, `@snowluma/ui`, and `@snowluma/mcp`), open
|
|
the package's npm settings and add a **GitHub Actions** trusted publisher with:
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Organization or user | `SnowLuma` |
|
|
| Repository | `SnowLuma` |
|
|
| Workflow filename | The exact filename below |
|
|
| Environment | `SnowLuma` |
|
|
|
|
| Package | Workflow filename |
|
|
| --- | --- |
|
|
| `@snowluma/sdk` | `sdk-npm-publish.yml` |
|
|
| `@snowluma/ui` | `ui-npm-publish.yml` |
|
|
| `@snowluma/mcp` | `mcp-npm-publish.yml` |
|
|
|
|
The workflow job keeps the `SnowLuma` GitHub Environment, so the environment
|
|
field must match exactly. The workflows grant `id-token: write`, use Node 24
|
|
(which provides a recent enough npm CLI), and publish with provenance. They do
|
|
not read `NPM_TOKEN`.
|
|
|
|
After all three entries are saved, rerun the failed workflow runs. Once a
|
|
successful publish is confirmed for every package, the obsolete `NPM_TOKEN`
|
|
environment secret can be removed from GitHub Actions settings.
|