Publish from CI with npm provenance (--provenance / OIDC trusted publisher) #2028

Activity

1. thymikee

   added

   needs-infoWaiting on reporter or external inputWaiting on reporter or external input

   on Aug 25, 2026
2. mahirhir commented on Aug 28, 2026

   

   mahirhir

   on Aug 28, 2026

   More actions

   Here is the complete .github/workflows/release.yml workflow implementing zero-secret npm Trusted Publishing with cryptographic build provenance:

   .github/workflows/release.yml

   name: Release
   
   on:
     push:
       tags:
         - "v*.*.*"
   
   permissions:
     contents: write
     id-token: write # Required for npm OIDC Trusted Publishing & Sigstore SLSA provenance
     attestations: write
   
   jobs:
     publish:
       runs-on: ubuntu-latest
       steps:
         - name: Checkout repository
           uses: actions/checkout@v4
           with:
             fetch-depth: 0
             token: ${{ secrets.GITHUB_TOKEN }}
   
         - name: Set up Node.js
           uses: actions/setup-node@v4
           with:
             node-version: 22
             registry-url: "https://registry.npmjs.org"
   
         - name: Install dependencies
           run: npm ci
   
         - name: Run test & verification suite
           run: |
             npm run typecheck
             npm test
             npm run build
   
         - name: Prepare release
           run: npm run release:prepare
   
         - name: Publish to npm with Provenance
           run: npm publish --provenance --access public
           env:
             NODE_AUTH_TOKEN: "" # Explicitly omitted; npm uses GitHub Actions OIDC token exchange
   
         - name: Mark development version on main branch
           run: |
             git config user.name "github-actions[bot]"
             git config user.email "github-actions[bot]@users.noreply.github.com"
             npm run release:mark-dev
             git push origin HEAD:main

   Verification

   Once configured on npmjs.com (Settings -> Publishing Access -> GitHub Actions OIDC), consumers can independently verify:

   npm view agent-device dist.attestations

   This produces a cryptographically signed Sigstore certificate linking the exact npm tarball SHA-512 back to the release workflow and commit SHA.
3. thymikee commented on Oct 9, 2026

   

   thymikee

   on Oct 9, 2026

   MemberAuthor

   More actions

   Decision: accepted, but it's more than the npm setting. We don't publish from CI today: releases go through scripts/release-workspace.mjs publish locally, and it publishes several workspace packages. So:

   1. Maintainer (npmjs.com), for each published package: add a trusted publisher with GitHub owner callstack, repository agent-device, the exact workflow filename, and the environment name if the job uses one.
   2. Repo: a release workflow on a GitHub-hosted runner with id-token: write, npm ≥ 11.5.1 and Node ≥ 22.14, driving release-workspace.mjs with pnpm. The contributed Ubuntu npm ci workflow doesn't fit our pnpm workspace or the macOS-built native Apple artifacts, so it needs adapting rather than dropping in.

   Step 2 can be written now; step 1 has to be done by the maintainer.
4. thymikee

   added

   ready-for-humanValid work that needs human implementation, judgment, or maintainer mergeValid work that needs human implementation, judgment, or maintainer merge

   and removed

   needs-infoWaiting on reporter or external inputWaiting on reporter or external input

   on Oct 9, 2026