From 4307b95aee3a3c3935e180e7d4344a3dfb3ac5d5 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Sat, 4 Jul 2026 09:43:12 -0400 Subject: [PATCH] ci(release): enable provenance and pin npm version for OIDC publish Align with modelcontextprotocol/inspector#1199: - set NPM_CONFIG_PROVENANCE so published packages get provenance attestations - pin the npm upgrade to ^11.5.1 instead of latest Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG --- .github/workflows/release.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0d9151b..e6456a5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -171,9 +171,9 @@ jobs: cache: npm registry-url: 'https://registry.npmjs.org' - # Trusted publishing requires npm >= 11.5.1; Node 22 bundles an older npm - - name: Update npm for trusted publishing - run: npm install -g npm@latest + # OIDC trusted publishing requires npm >=11.5.1; Node 22's bundled npm is 10.x. + - name: Ensure npm CLI supports OIDC trusted publishing + run: npm install -g npm@^11.5.1 - name: Install dependencies working-directory: src/${{ matrix.package }} @@ -199,6 +199,8 @@ jobs: working-directory: src/${{ matrix.package }} run: | npm publish --access public + env: + NPM_CONFIG_PROVENANCE: "true" create-release: needs: [update-packages, create-metadata, publish-pypi, publish-npm]