From 5c6ddf158bd18e4710635362cb989d852097aae7 Mon Sep 17 00:00:00 2001 From: Abimael Martell Date: Thu, 2 Apr 2026 12:14:21 -0700 Subject: [PATCH] fix publish: use trusted publisher pattern from cli repo (no NPM_TOKEN) Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/publish.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6f46a7e..c403447 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -60,16 +60,16 @@ jobs: name: Publish to npm needs: build runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - - uses: oven-sh/setup-bun@v2 + - uses: actions/setup-node@v6 with: - bun-version: latest - - - name: Install dependencies - working-directory: napi - run: bun install + node-version: '24' + registry-url: 'https://registry.npmjs.org' - name: Download all artifacts uses: actions/download-artifact@v4 @@ -85,4 +85,4 @@ jobs: echo "=== Package contents ===" ls -la *.node index.js index.d.ts - npm publish --access public --provenance + npm publish --provenance --access public