From 0cdcd4147b9a49c1cdb175564c9ab73714c0a311 Mon Sep 17 00:00:00 2001 From: hexqi Date: Thu, 29 Oct 2026 00:12:47 +0800 Subject: [PATCH 1/3] ci: migrate npm publishing to OIDC --- .github/workflows/auto-publish.yml | 14 +++++++++++--- .github/workflows/dispatch-publish.yml | 14 +++++++++++--- 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/.github/workflows/auto-publish.yml b/.github/workflows/auto-publish.yml index ac68b6fa..57bf7422 100644 --- a/.github/workflows/auto-publish.yml +++ b/.github/workflows/auto-publish.yml @@ -53,7 +53,18 @@ jobs: publish: needs: build runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: + - name: Setup Node for trusted publishing + uses: actions/setup-node@v4 + with: + node-version: 24 + + - name: Install OIDC-capable npm + run: npm install --global npm@11.6.0 + - name: Download build artifact uses: actions/download-artifact@v4 with: @@ -79,12 +90,9 @@ jobs: echo "publish tag: ${{ steps.parse_tag.outputs.dist_tag }}" - name: Publish @opentiny/fluent-editor run: | - echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc cd packages/fluent-editor/dist ls npm publish --tag ${{ steps.parse_tag.outputs.dist_tag }} - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Release if: ${{ steps.parse_tag.outputs.dist_tag == 'latest' }} diff --git a/.github/workflows/dispatch-publish.yml b/.github/workflows/dispatch-publish.yml index b1221a7d..87515a48 100644 --- a/.github/workflows/dispatch-publish.yml +++ b/.github/workflows/dispatch-publish.yml @@ -97,7 +97,18 @@ jobs: publish: needs: build runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: + - name: Setup Node for trusted publishing + uses: actions/setup-node@v4 + with: + node-version: 24 + + - name: Install OIDC-capable npm + run: npm install --global npm@11.6.0 + - name: Download build artifact uses: actions/download-artifact@v4 with: @@ -111,11 +122,8 @@ jobs: # 步骤8: 发布组件到NPM - name: Publish @opentiny/fluent-editor run: | - echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc echo "ls" ls cd packages/fluent-editor/dist ls npm publish --tag ${{ inputs.tag }} - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} From 2f17bbaa6c6d1f751926f68762f090df7881b85c Mon Sep 17 00:00:00 2001 From: hexqi Date: Thu, 29 Oct 2026 01:33:06 +0800 Subject: [PATCH 2/3] ci(publish): use bundled npm from supported Node 24 --- .github/workflows/auto-publish.yml | 5 +---- .github/workflows/dispatch-publish.yml | 5 +---- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/auto-publish.yml b/.github/workflows/auto-publish.yml index 57bf7422..c4572a3f 100644 --- a/.github/workflows/auto-publish.yml +++ b/.github/workflows/auto-publish.yml @@ -60,10 +60,7 @@ jobs: - name: Setup Node for trusted publishing uses: actions/setup-node@v4 with: - node-version: 24 - - - name: Install OIDC-capable npm - run: npm install --global npm@11.6.0 + node-version: '>=24.19.0 <25' - name: Download build artifact uses: actions/download-artifact@v4 diff --git a/.github/workflows/dispatch-publish.yml b/.github/workflows/dispatch-publish.yml index 87515a48..67810e09 100644 --- a/.github/workflows/dispatch-publish.yml +++ b/.github/workflows/dispatch-publish.yml @@ -104,10 +104,7 @@ jobs: - name: Setup Node for trusted publishing uses: actions/setup-node@v4 with: - node-version: 24 - - - name: Install OIDC-capable npm - run: npm install --global npm@11.6.0 + node-version: '>=24.19.0 <25' - name: Download build artifact uses: actions/download-artifact@v4 From bfa62f3f22ca1db85de98481ef96b5ff4c8a172f Mon Sep 17 00:00:00 2001 From: hexqi Date: Sun, 1 Nov 2026 16:59:20 +0800 Subject: [PATCH 3/3] ci: enforce OIDC runtime requirements and publishing permissions --- .github/workflows/auto-publish.yml | 2 +- .github/workflows/dispatch-publish.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-publish.yml b/.github/workflows/auto-publish.yml index c4572a3f..95fe9bc7 100644 --- a/.github/workflows/auto-publish.yml +++ b/.github/workflows/auto-publish.yml @@ -60,7 +60,7 @@ jobs: - name: Setup Node for trusted publishing uses: actions/setup-node@v4 with: - node-version: '>=24.19.0 <25' + node-version: '>=24.19.0 <25' # OIDC 需要 Node >=22.14.0 和 npm >=11.5.1；Node 24.5.0 起内置 npm >=11.5.1 - name: Download build artifact uses: actions/download-artifact@v4 diff --git a/.github/workflows/dispatch-publish.yml b/.github/workflows/dispatch-publish.yml index 67810e09..b4035522 100644 --- a/.github/workflows/dispatch-publish.yml +++ b/.github/workflows/dispatch-publish.yml @@ -104,7 +104,7 @@ jobs: - name: Setup Node for trusted publishing uses: actions/setup-node@v4 with: - node-version: '>=24.19.0 <25' + node-version: '>=24.19.0 <25' # OIDC 需要 Node >=22.14.0 和 npm >=11.5.1；Node 24.5.0 起内置 npm >=11.5.1 - name: Download build artifact uses: actions/download-artifact@v4