From ee15ee0adfe7a3c229bc16a4e412ebf89b5407e8 Mon Sep 17 00:00:00 2001 From: Marc Villain Date: Tue, 20 Oct 2026 13:16:37 +0200 Subject: [PATCH] ci: stage releases for 2FA approval instead of publishing them The npm trusted publisher may only stage, so a version goes live once a maintainer approves it with 2FA. Staging needs npm 11.15 or later; Node 24.12 ships 11.6, so the job installs a pinned npm first. --- .github/workflows/publish.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ee42164..5572f40 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,8 +1,10 @@ -# Publishes @crudy/pgmorbac-fastify to npmjs on version tags (v..) +# Stages @crudy/pgmorbac-fastify to npmjs on version tags (v..) # through npm trusted publishing: GitHub's OIDC token stands in for an npm # token, and npm attaches a provenance statement naming this repository and -# commit. The organisation only allows its own actions, so checkout and Node -# setup are plain shell. prepack builds dist from src. +# commit. The trusted publisher may only stage: a staged version goes live once +# a maintainer approves it with 2FA (npm stage approve, or npmjs.com). The +# organisation only allows its own actions, so checkout and Node setup are +# plain shell. prepack builds dist from src. name: publish on: @@ -35,6 +37,8 @@ jobs: tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1 rm "$file" echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH" + - name: Install npm with staged publishing + run: npm install -g npm@11.21.1 - run: npm install --no-audit --no-fund - run: npm run check - name: Publish @@ -45,5 +49,5 @@ jobs: if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then echo "$NAME@$VERSION is already published" else - npm publish --access public + npm stage publish fi