[hivecommons-hive]

What changed

Mirror of hivecommons/promptargs#223: .github/workflows/publish.yml now publishes to npm via Trusted Publishing (OIDC) instead of the long-lived NPM_TOKEN secret.

• Comment block on the publish job documenting the expected npm-side Trusted Publisher.
• setup-node node-version 22 -> 24 (action SHA unchanged).
• New "Ensure npm supports Trusted Publishing" step (npm >= 11.5.1, upgrade fallback).
• New "Require OIDC token for npm Trusted Publishing" step checking ACTIONS_ID_TOKEN_REQUEST_URL.
• Publish step renamed Publish to npm (Trusted Publishing), with no NODE_AUTH_TOKEN/env.
• runbooks/publish-failure.md now describes the Trusted Publisher check instead of NPM_TOKEN.
• Changelog fragment changelog.d/changed-publish-trusted-publishing.md.

The repo has 0 GitHub Environments, so the Trusted Publisher environment field stays blank.

Before merging (maintainer action required)

1. On npmjs.com for @hivecommons/pluk, add a Trusted Publisher: GitHub Actions, owner hivecommons, repository pluk, workflow publish.yml, environment blank.
2. After the first successful OIDC publish, delete the NPM_TOKEN repository secret.

Please add hold until the npm-side Trusted Publisher is configured — merging first would break the next tag publish.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

hive/awaiting-ci: needs the npm-side Trusted Publisher configured by a maintainer before merge; please apply hold. CI pending.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Converted to draft deliberately: agents cannot apply hold, and this must not merge before the npm-side Trusted Publisher for @hivecommons/pluk (GitHub Actions · owner hivecommons · repo pluk · workflow publish.yml · environment blank) exists — otherwise the next v* tag publish fails. @clubanderson once that is configured, mark ready for review and it merges on green CI; then delete the NPM_TOKEN secret after the first OIDC publish.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (security) — no blockers; one low-severity note.

• .github/workflows/publish.yml:67 — the fallback npm install -g npm@latest is unpinned and runs inside the job that holds the OIDC token (the same job whose comment at lines 70-71 says lifecycle scripts must not run there). With node-version: 24 (line 58) the bundled npm is ≥ 11.5.1 so this branch is unlikely to be taken, but when it is, it pulls an uninspected latest npm into the publish job. Consider pinning (e.g. npm@11.5.1 or a specific version) so the fallback is deterministic.

Verified unchanged trust boundary: permissions: id-token: write (lines 9-11) was already present at merge-base for --provenance; verify-tag (lines 30-36) still restricts publishing to tags reachable from main, which matches the exposure the previous NPM_TOKEN already had on tag pushes.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (docs-currency) — one minor in-scope gap, non-blocking.

• .github/workflows/publish.yml:88 — the new "Require OIDC token" step fails with …see runbooks/publish-failure.md when ACTIONS_ID_TOKEN_REQUEST_URL is unset (no id-token: write). But runbooks/publish-failure.md:32-38 only describes the other OIDC failure (npm rejecting the token → check the Trusted Publisher on npmjs.com). An operator following the error message finds no guidance for the case it names. Suggest one sentence in that section: if the job failed at "Require OIDC token", the id-token: write permission at publish.yml:9-11 was removed or is not granted in this run context (e.g. a fork/dispatch) — restore it and re-run.

Checked: runbooks/release-rollback.md, runbooks/README.md, CONTRIBUTING.md, README.md — no remaining NPM_TOKEN/NODE_AUTH_TOKEN references; Node 24 for the publish job is already in the test.yml:22 matrix.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

f8eef2a

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head f8eef2af2de2) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/publish.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[kubestellar-prow]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[clubanderson]

Closing as superseded.

OIDC Trusted Publishing is already live on main via #303 (merged 2026-10-19), which carries everything this PR proposed for .github/workflows/publish.yml and runbooks/publish-failure.md:

• npm >= 11.5.1 guard (main pins npm@11.5.1 instead of npm@latest — safer in the job holding the OIDC token)
• ACTIONS_ID_TOKEN_REQUEST_URL pre-publish check
• npm publish --access public --provenance with no NODE_AUTH_TOKEN / NPM_TOKEN
• publish job bound to the npm GitHub Environment (this PR assumed no environment)
• runbook updated to describe the Trusted Publisher instead of NPM_TOKEN

The NPM_TOKEN secret has been deleted. The only piece not on main is the one-line changelog.d/changed-publish-trusted-publishing.md fragment, which is being added in a separate follow-up PR. Nothing else here remains to merge; this branch is also needs-rebase/conflicting against the landed version.