🔒 ci: publish to npm via Trusted Publishing (OIDC) instead of NPM_TOKEN

[clubanderson]

Closes #293

Switch the publish job in .github/workflows/publish.yml from a long-lived NPM_TOKEN repository secret to npm Trusted Publishing (GitHub Actions OIDC), mirroring hivecommons/rationguard#252 and hivecommons/promptargs#223.

Workflow changes

• publish job now runs in the npm GitHub Environment (created; deployment restricted to v* tags) with job-level permissions: { contents: read, id-token: write }.
• Pinned npm ≥ 11.5.1 guard (npm install -g npm@11.5.1 only if the bundled npm is older — never npm@latest inside the job holding the OIDC token).
• OIDC preflight: fail fast if ACTIONS_ID_TOKEN_REQUEST_URL is unset.
• npm publish --access public --provenance with no NODE_AUTH_TOKEN / NPM_TOKEN (npm rejects OIDC publishes when a token is also present).
• runbooks/publish-failure.md updated to describe OIDC auth instead of NPM_TOKEN.

npm-side prerequisite (⚠️ must be done before merging — PR is on hold)
On npmjs.com → @hivecommons/pluk → Settings → Trusted Publisher → GitHub Actions: organization hivecommons, repository pluk, workflow filename publish.yml, environment npm. Equivalent CLI: npm trust github @hivecommons/pluk --repo hivecommons/pluk --file publish.yml --env npm --allow-publish.

After this PR merges and the first OIDC publish succeeds: set Publishing access to "Require 2FA and disallow tokens", revoke the npm token, and delete the NPM_TOKEN repository secret.

[hivecommons-hive]

f1a39a7

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head f1a39a7c6e86) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/publish.yml
• permission_escalation — widens workflow permissions or uses pull_request_target (Widens GitHub Actions permissions or switches to pull_request_target)
  • .github/workflows/publish.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[clubanderson]

/hold cancel
/lgtm
/approve

Trusted publisher registered on npmjs.com for @hivecommons/pluk (hivecommons/pluk, publish.yml, env npm). Merging.

[kubestellar-prow]

@clubanderson: you cannot LGTM your own PR.

Details

In response to this:

/hold cancel
/lgtm
/approve

Trusted publisher registered on npmjs.com for @hivecommons/pluk (hivecommons/pluk, publish.yml, env npm). Merging.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

[hivecommons-hive]

Reviewed (correctness) — workflow change is sound; one advisory on the environment settings.

• .github/workflows/publish.yml:50-53,56-60,92-93: environment: npm + job-level id-token: write, setup-node with registry-url and no NODE_AUTH_TOKEN, then npm publish --provenance — identical shape to hivecommons/rationguard publish.yml lines 62-95, whose tag runs (v0.11.0–v0.13.0) all succeeded, so the ${NODE_AUTH_TOKEN} placeholder .npmrc that setup-node writes does not break OIDC on npm ≥ 11.5.1. The verify-tag → publish → release chain is unchanged.
• Advisory (settings, not code): GET /repos/hivecommons/pluk/environments/npm shows only a branch_policy (v* tag) — no required_reviewers. Issue #293 checkbox 3 asks for "tag restriction v* and required reviewer" so that auto-release.yml's dispatch becomes an approve-to-publish step. Either add a reviewer on the npm environment before closing #293, or note in the PR body that the reviewer gate was deliberately omitted so the checkbox can be ticked accurately.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed (security) — no in-scope findings. Verified at head f1a39a7: publish job has job-level contents: read + id-token: write and environment: npm (.github/workflows/publish.yml:50-53); the npm environment exists with a v* tag deployment policy; npm publish runs with no NODE_AUTH_TOKEN/secrets.* (publish.yml:92-93); the npm upgrade is version-pinned (publish.yml:68).

Out-of-scope advisory (pre-existing, backlog): workflow-level permissions still grants id-token: write to every job (publish.yml:9-11), so verify-tag receives an OIDC-capable token it never uses. Now that publish declares its own permissions, the top-level block can be narrowed:

permissions:
  contents: read

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Hive filed review findings that do not block this PR as backlog items:

• Review backlog (security): Workflow-level id-token: write still granted to all jobs #304 — Review backlog (security): Workflow-level id-token: write still granted to all jobs (Review backlog (security): Workflow-level id-token: write still granted to all jobs #304)

Cap: 10 backlog item(s) per PR per day.

[hivecommons-hive]

Reviewed (style/maintainability) — one advisory, non-blocking. Read at f1a39a7.

id-token: write is now declared twice — .github/workflows/publish.yml:9-11 (workflow level, pre-existing) and :51-53 (job level, added by this PR). The job-level block is the right place for it, but leaving the workflow-level grant means two places to keep in sync, and verify-tag (:14) still gets an OIDC token it never uses. Suggest narrowing the top-level block so the job-level declaration is the single source of truth:

permissions:
  contents: read

(release already declares its own contents: write at :100-101, so nothing else depends on the top-level block.)

Everything else — the version guard (:61-70), preflight (:86-91), unnamed npm publish → named step (:92-93), and the runbook wording (runbooks/publish-failure.md:32-36) — matches the block prescribed in #293 and the rationguard counterpart.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88