ci(sdk-npm): publish @smbcloud/sdk-auth with npm trusted publishing
The SDK npm release still authenticated with the NPM_TOKEN secret, which npm stopped accepting in August. Every run since v0.5.3 has ended in E404 on the publish step, so @smbcloud/sdk-auth is stuck at 0.5.2. Grant the job id-token: write and drop NODE_AUTH_TOKEN so npm publishes over OIDC, the way release-npm.yml already does for the CLI packages. The package needs a trusted publisher on npmjs.com pointing at release-sdk-npm.yml before the next release. Refs #66 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-Authored-By: siGit Code v1.6.7 <noreply@sigit.si>
keypair34 committed
Oct 12, 2026 at 15:00 UTC
619f1960b0d70943a00fd8a1d02cd9a5bb15e3b5
1 file changed
+9
-4
.github/workflows/release-sdk-npm.yml
+9
-4
@@ -3,8 +3,13 @@ name: SDK npm Release
3
# Publishes @smbcloud/sdk-auth (WASM) to npm.
4
# WASM is a single universal target — no platform matrix needed.
5
#
6
-# Required secrets:
7
-# NPM_TOKEN — npm access token with publish rights to @smbcloud/sdk-auth
6
+# Authenticates with npm trusted publishing (OIDC), so there is no npm token
7
+# to store or rotate. The package needs a trusted publisher on npmjs.com that
8
+# names this repository and this workflow file:
9
+#
10
+# npm trust github @smbcloud/sdk-auth --repo smbcloudXYZ/smbcloud-cli --file release-sdk-npm.yml
11
+#
12
+# OIDC publishing needs npm >= 11.5.1 and Node >= 22.14.0; .nvmrc covers both.
13
14
on:
15
workflow_dispatch:
@@ -14,6 +19,8 @@ on:
19
required: true
20
21
permissions:
22
+ # Lets the job request the OIDC token npm exchanges for publish rights.
23
+ id-token: write
24
contents: read
25
26
env:
@@ -110,6 +117,4 @@ jobs:
117
- name: Publish to npm
118
if: steps.npm-check.outputs.exists != 'true'
119
working-directory: sdk/npm/smbcloud-auth
113
- env:
114
- NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
120
run: npm publish --access public