@ckeditor/ckeditor5-dev-release-tools 62.1.0 → 62.2.0

package/lib/tasks/publishpackages.js

@@ -79,15 +79,7 @@ export default async function publishPackages( options ) {
 		attempts = 5
 	} = options;
 
-	if ( useOidc ) {
-		// npm exchanges the OIDC token only during supported operations, such as `npm publish`, and `npm whoami`
-		// does not reflect Trusted Publishing authentication. Hence, only the token presence can be verified upfront.
-		if ( !process.env.NPM_ID_TOKEN ) {
-			throw new Error( 'The "NPM_ID_TOKEN" environment variable is required when publishing using npm Trusted Publishing (OIDC).' );
-		}
-	} else {
-		await assertNpmAuthorization( npmOwner );
-	}
+	await assertNpmAuthorization( npmOwner, { useOidc } );
 
 	// Find packages that would be published...
 	const packagePaths = await workspaces.findPathsToPackages( cwd, packagesDirectory );

package/lib/tasks/reassignnpmtags.js

@@ -19,8 +19,14 @@ const execPromise = promisify( exec );
  * It supports built-in tags (e.g. `latest`, `staging`, `next`) and custom tags (e.g. `latest-v{X}`).
  * Each operation will be retried up to 3 times in case of failure.
  *
+ * When using npm Trusted Publishing (`useOidc`), the `npm whoami` check is replaced by verifying that the `NPM_ID_TOKEN`
+ * environment variable is set, as `npm whoami` does not reflect OIDC authentication. It requires npm 11.21.0 or newer
+ * and a trusted publisher that allows the `npm dist-tag` command.
+ *
  * @param {object} options
- * @param {string} options.npmOwner User that is authorized to release packages.
+ * @param {string} [options.npmOwner] User that is authorized to release packages. Required unless `useOidc` is enabled.
+ * @param {boolean} [options.useOidc=false] Whether to authorize using npm Trusted Publishing (OIDC). When enabled,
+ * the `npm whoami` authorization check is skipped and the `NPM_ID_TOKEN` environment variable must be set instead.
  * @param {string} options.version Specifies the version of packages to reassign the tags for.
  * @param {Array.<string>} options.packages Array of packages' names to reassign tags for.
  * @param {string} [options.npmTag='latest'] Npm dist-tag to assign.
@@ -29,6 +35,7 @@ const execPromise = promisify( exec );
 export default async function reassignNpmTags( options ) {
 	const {
 		npmOwner,
+		useOidc = false,
 		version,
 		packages,
 		npmTag = 'latest'
@@ -38,7 +45,7 @@ export default async function reassignNpmTags( options ) {
 	const packagesSkipped = [];
 	const packagesUpdated = [];
 
-	await assertNpmAuthorization( npmOwner );
+	await assertNpmAuthorization( npmOwner, { useOidc } );
 
 	const counter = tools.createSpinner( 'Reassigning npm tags...', { total: packages.length } );
 	counter.start();

package/lib/utils/assertnpmauthorization.js

@@ -8,10 +8,25 @@ import { tools } from '@ckeditor/ckeditor5-dev-utils';
 /**
  * Checks whether a user is logged to npm as the provided account name.
  *
- * @param {string} npmOwner Expected npm account name that should be logged into npm.
+ * When using npm Trusted Publishing (`useOidc`), the check verifies that the `NPM_ID_TOKEN` environment variable is set
+ * instead. npm exchanges the OIDC token only during supported operations, such as `npm publish` or `npm dist-tag`,
+ * and `npm whoami` does not reflect Trusted Publishing authentication.
+ *
+ * @param {string} [npmOwner] Expected npm account name that should be logged into npm. Required unless `useOidc` is enabled.
+ * @param {object} [options={}]
+ * @param {boolean} [options.useOidc=false] Whether to verify the npm Trusted Publishing (OIDC) setup instead of the npm account.
  * @returns {Promise}
  */
-export default async function assertNpmAuthorization( npmOwner ) {
+export default async function assertNpmAuthorization( npmOwner, { useOidc = false } = {} ) {
+	if ( useOidc ) {
+		// Only the token presence can be verified upfront.
+		if ( !process.env.NPM_ID_TOKEN ) {
+			throw new Error( 'The "NPM_ID_TOKEN" environment variable is required when using npm Trusted Publishing (OIDC).' );
+		}
+
+		return;
+	}
+
 	return tools.shExec( 'npm whoami', { verbosity: 'error', async: true } )
 		.then( npmCurrentUser => {
 			if ( npmOwner !== npmCurrentUser.trim() ) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-dev-release-tools",
-  "version": "62.1.0",
+  "version": "62.2.0",
   "description": "Tools used for releasing CKEditor 5 and related packages.",
   "keywords": [],
   "author": "CKSource (http://cksource.com/)",
@@ -22,7 +22,7 @@
     "lib"
   ],
   "dependencies": {
-    "@ckeditor/ckeditor5-dev-utils": "^62.1.0",
+    "@ckeditor/ckeditor5-dev-utils": "^62.2.0",
     "@octokit/rest": "^22.0.1",
     "cli-columns": "^4.0.0",
     "glob": "^13.0.6",