Allow GitHub Actions to publish without requiring an access token #872
-
|
I maintain many npm packages, and the publish process is handled by GitHub Actions. Right now I had to add the Existing approaches and their respective problems:
Right now I use a combination of these approaches (start with approach A, and migrate to approach C when the project is shared). It makes everything more complicated. GitHub Actions can generate OIDC tokens which can be used to securely identify the workload. It would be great if npm allowed giving access to GitHub repositories in addition to npm users, similar to how AWS, Azure, and Google Cloud allows using GitHub Actions OIDC tokens to manage a cloud resource without storing secret credentials in the repository config. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment
-
|
We are currently in the process of investigating OIDC support for npm. As we get more clarity on how long it will take to build we'll update the public roadmap (and I'll update this discussion) |
Beta Was this translation helpful? Give feedback.
We are currently in the process of investigating OIDC support for npm. As we get more clarity on how long it will take to build we'll update the public roadmap (and I'll update this discussion)