fix: gitlab example for trusted publishing (#1710)
I haven't been quite able to make trusted publishing work in GitLab (see https://github.com/npm/cli/issues/8558), but I do think the example is incorrect. `id_tokens` is not a valid global keyword. It needs to be specified under `default` or a job. I think a job makes more sense. Reference: * https://docs.gitlab.com/ci/yaml/#global-keywords * https://docs.gitlab.com/ci/yaml/#default * https://docs.gitlab.com/ci/yaml/#id_tokens
Roberto Vidal committed
Sep 10, 2025 at 22:34 UTC
f4d04c48696a815985efa2ca4b6902e1ade22a1e
1 file changed
+3
-4
content/packages-and-modules/securing-your-code/trusted-publishers.mdx
+3
-4
@@ -118,10 +118,6 @@ stages:
118
variables:
119
NODE_VERSION: '20'
120
121
-id_tokens:
122
- NPM_ID_TOKEN:
123
- aud: "npm:registry.npmjs.org"
124
-
121
test:
122
stage: test
123
image: node:${NODE_VERSION}
@@ -132,6 +128,9 @@ test:
128
publish:
129
stage: publish
130
image: node:${NODE_VERSION}
131
+ id_tokens:
132
+ NPM_ID_TOKEN:
133
+ aud: "npm:registry.npmjs.org"
134
script:
135
# Ensure npm 11.5.1 or later is installed
136
- npm install -g npm@latest