@ckeditor/ckeditor5-dev-release-tools 62.2.0 → 62.3.0

package/lib/index.js

@@ -33,3 +33,4 @@ export { default as validateRepositoryToRelease } from './utils/validatereposito
 export { default as getNpmTagFromVersion } from './utils/getnpmtagfromversion.js';
 export { default as provideToken } from './utils/providetoken.js';
 export { default as validateGithubToken } from './utils/validategithubtoken.js';
+export { default as getNpmIdToken } from './utils/getnpmidtoken.js';

package/lib/tasks/publishpackages.js

@@ -119,7 +119,8 @@ export default async function publishPackages( options ) {
 		listrTask,
 		taskToExecute: publishPackageOnNpmCallback,
 		taskOptions: {
-			npmTag
+			npmTag,
+			useOidc
 		},
 		signal,
 		concurrency,

package/lib/tasks/reassignnpmtags.js

@@ -10,6 +10,7 @@ import { styleText, promisify } from 'node:util';
 import columns from 'cli-columns';
 import shellEscape from 'shell-escape';
 import assertNpmAuthorization from '../utils/assertnpmauthorization.js';
+import getNpmIdToken from '../utils/getnpmidtoken.js';
 import { exec } from 'node:child_process';
 
 const execPromise = promisify( exec );
@@ -52,7 +53,14 @@ export default async function reassignNpmTags( options ) {
 
 	const updateTagPromises = packages.map( async packageName => {
 		const command = `npm dist-tag add ${ shellEscape( [ packageName ] ) }@${ shellEscape( [ version ] ) } ${ npmTag }`;
-		const updateLatestTagRetryable = retry( () => execPromise( command ) );
+		const updateLatestTagRetryable = retry( async () => {
+			if ( !useOidc ) {
+				return execPromise( command );
+			}
+
+			// The calls run in parallel, so the fresh token is passed only to this npm process.
+			return execPromise( command, { env: { ...process.env, NPM_ID_TOKEN: await getNpmIdToken() } } );
+		} );
 		await updateLatestTagRetryable()
 			.then( response => {
 				if ( response.stdout ) {

package/lib/utils/assertnpmauthorization.js

@@ -4,12 +4,13 @@
  */
 
 import { tools } from '@ckeditor/ckeditor5-dev-utils';
+import getNpmIdToken from './getnpmidtoken.js';
 
 /**
  * Checks whether a user is logged to npm as the provided account name.
  *
- * When using npm Trusted Publishing (`useOidc`), the check verifies that the `NPM_ID_TOKEN` environment variable is set
- * instead. npm exchanges the OIDC token only during supported operations, such as `npm publish` or `npm dist-tag`,
+ * When using npm Trusted Publishing (`useOidc`), the check verifies that an OIDC token can be obtained instead
+ * (see `getNpmIdToken()`). npm exchanges the OIDC token only during supported operations, such as `npm publish` or `npm dist-tag`,
  * and `npm whoami` does not reflect Trusted Publishing authentication.
  *
  * @param {string} [npmOwner] Expected npm account name that should be logged into npm. Required unless `useOidc` is enabled.
@@ -19,10 +20,9 @@ import { tools } from '@ckeditor/ckeditor5-dev-utils';
  */
 export default async function assertNpmAuthorization( npmOwner, { useOidc = false } = {} ) {
 	if ( useOidc ) {
-		// Only the token presence can be verified upfront.
-		if ( !process.env.NPM_ID_TOKEN ) {
-			throw new Error( 'The "NPM_ID_TOKEN" environment variable is required when using npm Trusted Publishing (OIDC).' );
-		}
+		// A token is requested again before each npm command. Requesting one here stops the release before any package
+		// is processed when no token can be obtained (neither from the CircleCI CLI nor from `NPM_ID_TOKEN`).
+		await getNpmIdToken();
 
 		return;
 	}

package/lib/utils/getnpmidtoken.js

@@ -0,0 +1,72 @@
+/**
+ * @license Copyright (c) 2003-2026, CKSource Holding sp. z o.o. All rights reserved.
+ * For licensing, see LICENSE.md.
+ */
+
+import { execFile } from 'node:child_process';
+
+/**
+ * The audience that npm expects in an OIDC token used in the npm Trusted Publishing token exchange.
+ */
+export const NPM_OIDC_AUDIENCE = 'npm:registry.npmjs.org';
+
+/**
+ * Returns an OIDC token that the npm CLI exchanges for a short-lived npm token (npm Trusted Publishing).
+ *
+ * npm accepts a CircleCI OIDC token in the exchange only for a few minutes after it was issued, even though the token
+ * itself is valid longer. A release that publishes many packages takes longer than that. Hence, on CircleCI, a fresh
+ * token is requested each time, right before an npm command that needs it.
+ *
+ * When the CircleCI CLI is not available, or the command does not run on CircleCI, the `NPM_ID_TOKEN` environment
+ * variable is used, if it is set.
+ *
+ * @returns {Promise<string>}
+ */
+export default async function getNpmIdToken() {
+	if ( process.env.CIRCLECI ) {
+		const token = await requestCircleciToken();
+
+		if ( token ) {
+			return token;
+		}
+	}
+
+	if ( process.env.NPM_ID_TOKEN ) {
+		return process.env.NPM_ID_TOKEN;
+	}
+
+	throw new Error(
+		'Cannot get an OIDC token for npm Trusted Publishing (OIDC). ' +
+		'Run the command on CircleCI or set the "NPM_ID_TOKEN" environment variable.'
+	);
+}
+
+/**
+ * Requests a fresh OIDC token using the CircleCI CLI. Resolves `null` when the CLI is not installed.
+ *
+ * @returns {Promise<string|null>}
+ */
+async function requestCircleciToken() {
+	const args = [ 'run', 'oidc', 'get', '--claims', JSON.stringify( { aud: NPM_OIDC_AUDIENCE } ) ];
+	let stdout;
+
+	try {
+		stdout = await new Promise( ( resolve, reject ) => {
+			execFile( 'circleci', args, ( error, output ) => error ? reject( error ) : resolve( output ) );
+		} );
+	} catch ( error ) {
+		if ( error.code === 'ENOENT' ) {
+			return null;
+		}
+
+		throw error;
+	}
+
+	const token = String( stdout ).trim();
+
+	if ( !token ) {
+		throw new Error( 'The `circleci run oidc get` command returned an empty OIDC token.' );
+	}
+
+	return token;
+}

package/lib/utils/publishpackageonnpmcallback.js

@@ -9,17 +9,26 @@
  * @param {string} packagePath
  * @param {object} taskOptions
  * @param {string} taskOptions.npmTag
+ * @param {boolean} [taskOptions.useOidc=false] Whether to request a fresh OIDC token for npm Trusted Publishing before publishing.
  * @returns {Promise}
  */
 export default async function publishPackageOnNpmCallback( packagePath, taskOptions ) {
-	const { tools } = await import( '@ckeditor/ckeditor5-dev-utils' );
+	// The callback runs in a worker thread, so dependencies are imported dynamically and resolve from the project root.
+	const { exec } = await import( 'node:child_process' );
 	const { rm } = await import( 'node:fs/promises' );
+	const { getNpmIdToken } = await import( '@ckeditor/ckeditor5-dev-release-tools' );
 
 	try {
-		await tools.shExec( `npm publish --access=public --tag ${ taskOptions.npmTag }`, {
-			cwd: packagePath,
-			async: true,
-			verbosity: 'silent'
+		const env = taskOptions.useOidc ? { ...process.env, NPM_ID_TOKEN: await getNpmIdToken() } : process.env;
+
+		if ( !/^[a-z0-9][a-z0-9._-]*$/i.test( taskOptions.npmTag ) ) {
+			throw new Error( `Invalid npm tag: "${ taskOptions.npmTag }".` );
+		}
+
+		const command = `npm publish --access=public --tag ${ taskOptions.npmTag }`;
+
+		await new Promise( ( resolve, reject ) => {
+			exec( command, { cwd: packagePath, env }, error => error ? reject( error ) : resolve() );
 		} );
 
 		await rm( packagePath, { recursive: true, force: true } );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ckeditor/ckeditor5-dev-release-tools",
-  "version": "62.2.0",
+  "version": "62.3.0",
   "description": "Tools used for releasing CKEditor 5 and related packages.",
   "keywords": [],
   "author": "CKSource (http://cksource.com/)",
@@ -22,7 +22,7 @@
     "lib"
   ],
   "dependencies": {
-    "@ckeditor/ckeditor5-dev-utils": "^62.2.0",
+    "@ckeditor/ckeditor5-dev-utils": "^62.3.0",
     "@octokit/rest": "^22.0.1",
     "cli-columns": "^4.0.0",
     "glob": "^13.0.6",