@ludeo/cloud-common 1.2.264 → 1.2.267

package/.github/workflows/main.yaml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "20"
-          registry-url: 'https://registry.npmjs.org/'
+          registry-url: "https://registry.npmjs.org/"
 
       - name: 🔐 Login to Ludeo NPM
         run: |
@@ -68,8 +68,9 @@ jobs:
   publish:
     if: github.ref == 'refs/heads/develop'
     runs-on: ubuntu-latest
-    env:
-      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+    permissions:
+      id-token: write
+      contents: write
 
     steps:
       - name: Checkout code
@@ -79,7 +80,18 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "20"
-          registry-url: 'https://registry.npmjs.org/'
+          registry-url: "https://registry.npmjs.org/"
+
+      # Trusted publishing requires npm >= 11.5.1 to perform the OIDC token exchange.
+      # Node 20 ships with npm 10.x, so upgrade explicitly.
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest
+
+      # Token still needed to install private @ludeo/* dependencies from the registry.
+      # Publishing itself uses OIDC trusted publishing (no token).
+      - name: 🔐 Login to Ludeo NPM (install only)
+        run: |
+          npm config set @ludeo:registry https://registry.npmjs.org/ && npm config set '//registry.npmjs.org/:_authToken' ${{ secrets.NPM_TOKEN }}
 
       - name: 🏗️ Install dependencies
         run: npm install
@@ -87,8 +99,10 @@ jobs:
       - name: 🛠 Run build 🛠️
         run: npm run build
 
-      - name: 🏗️ Install jq
-        run: sudo apt-get install -y jq
+      # Drop any token from the user-level .npmrc so npm publish performs the OIDC exchange
+      # against the npm registry instead of using the install token.
+      - name: Clear npm auth token before publish
+        run: npm config delete //registry.npmjs.org/:_authToken
 
       - name: 📦 Publish to npm
         run: npm publish