From bdbd64e0ffa7f958185ead6b68ce5d10ed428eac Mon Sep 17 00:00:00 2001 From: neverland Date: Mon, 4 Aug 2025 14:49:49 +0800 Subject: [PATCH] chore: enable npm trusted publishing --- .github/workflows/release.yml | 16 +++++++++++----- package.json | 3 +-- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 987c36d..e9af016 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,18 +16,24 @@ permissions: jobs: publish: runs-on: ubuntu-latest + environment: npm steps: - name: Checkout uses: actions/checkout@v4 - - name: Install Pnpm - run: npm i -g corepack@latest --force && corepack enable - - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: 22 - cache: "pnpm" + + # Update npm to the latest version to enable OIDC + # Use corepack to install pnpm + - name: Setup Package Managers + run: | + npm install -g npm@latest + npm --version + npm install -g corepack@latest --force + corepack enable - name: Install Dependencies run: pnpm install @@ -35,7 +41,7 @@ jobs: - name: Publish uses: JS-DevTools/npm-publish@v3 with: - token: ${{ secrets.NPM_TOKEN }} + token: empty - name: Create GitHub Release uses: ncipollo/release-action@v1 diff --git a/package.json b/package.json index fc76f25..58bb811 100644 --- a/package.json +++ b/package.json @@ -57,7 +57,6 @@ "packageManager": "pnpm@10.14.0", "publishConfig": { "access": "public", - "registry": "https://registry.npmjs.org/", - "provenance": true + "registry": "https://registry.npmjs.org/" } }