ITADN

Support OIDC publishing

#771ClosedWillsB3 创建于 2025-11-18
enhancementhelp wanted
W
WillsB3commented
## Description NPM has recently disabled classic access tokens and now recommends publishing via OIDC to avoid the need for long-lived tokens altogether (See https://docs.npmjs.com/trusted-publishers). **Is the feature request related to a problem?** As far as I have been able to deduce, `np` does not current allow publishing of packages via OIDC because the NPM prerequisite checks try and verify the currently logged in npm user ([source](https://github.com/sindresorhus/np/blob/main/source/prerequisite-tasks.js#L27-L45)) in a way that I believe is not OIDC compatible. From the NPM docs: > The npm whoami command will not reflect OIDC authentication status since the authentication occurs only during the publish operation. When I try and run `np` within our `release.yml` Github action I get the following error: ``` [10:39:09] Prerequisite check [started] [10:39:09] Ping npm registry [started] [10:39:09] Ping npm registry [completed] [10:39:09] Check npm version [started] [10:39:09] Check npm version [completed] [10:39:09] Verify user is authenticated [started] [10:39:10] Verify user is authenticated [failed] [10:39:10] → Authentication error. Use `npm whoami` to troubleshoot. [10:39:10] Prerequisite check [failed] [10:39:10] → Authentication error. Use `npm whoami` to troubleshoot. ✖️ Error: Authentication error. Use `npm whoami` to troubleshoot. at Module.username (file:///home/runner/work/ui/ui/node_modules/np/source/npm/util.js:42:9) at process.processTicksAndRejections (node:internal/process/task_queues:105:5) at async Task.task (file:///home/runner/work/ui/ui/node_modules/np/source/prerequisite-tasks.js:30:22) Aborted! ``` Indeed, there is no user authenticated with the `npm` CLI in the runner, since we have setup Github as a trusted publisher and added the `id-token` permission to the CLI job which, per [the NPM documentation](https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow), should allow the package to be published. ## Possible implementation I don't have any specific recommendations, but some ideas: * A new flag e.g. --skip-npm-auth-check which skip the relevant prerequesit task (this doesn't feel like a great solution…) * Update `np` to try and detect if it is running in an environment where OIDC is available (see https://github.com/npm/cli/blob/latest/lib/utils/oidc.js#L49-L67). This would be smarter, but would also require more maintenance on `np`'s side to update any checks made as NPM expands support for providers other than GitHub/GitLab. ## Alternatives No workarounds known at the point in time.
关闭于 2026-01-20 2 条评论