Skip to content

Conversation

@tanjeemh
Copy link

@tanjeemh tanjeemh commented Nov 17, 2025

What problem are we solving?
As npm has let us know that they are revoking all classic npm-tokens this month, we are migrating to using OIDC Trusted Publishing instead.

Why are we solving it this way?

  • id-token: write permissions is required for OIDC authentication
  • set a Github Environment called publish-ecpair for secure deployments to the master branch
  • ensure npm is at least up to v11.5.1 for OIDC Trusted Publishing compatibility
  • update semantic-release package as OIDC Trusted Publishing is not compatible with v19
  • proxyquire updated its declaration to var proxyquire = require('proxyquire') as per their npm docs

Ticket: DX-2321

@tanjeemh tanjeemh requested review from a team as code owners November 17, 2025 20:50
@tanjeemh tanjeemh closed this Nov 18, 2025
@tanjeemh tanjeemh reopened this Nov 18, 2025
@tanjeemh tanjeemh force-pushed the DX-2321 branch 6 times, most recently from d050e3d to df4a0ee Compare November 18, 2025 20:12
@mullapudipruthvik mullapudipruthvik merged commit 1dc353a into master Nov 19, 2025
8 checks passed
@mullapudipruthvik mullapudipruthvik deleted the DX-2321 branch November 19, 2025 21:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants