@qlover/fe-release 5.1.0 → 5.3.2

package/dist/cli.cjs

@@ -28,7 +28,7 @@ var import_commander = require("commander");
 
 // package.json
 var description = "A tool for releasing front-end projects, supporting multiple release modes and configurations, simplifying the release process and improving efficiency.";
-var version = "5.1.0";
+var version = "5.3.2";
 
 // src/cli.ts
 var import_semver = __toESM(require("semver"), 1);
@@ -1610,6 +1610,22 @@ var ChangesetVersion = class extends import_scripts_context4.ScriptPlugin {
   get ignoreNonUpdatedPackages() {
     return !!this.config.ignoreNonUpdatedPackages;
   }
+  get useTrustedPublishing() {
+    return !!(this.config.useTrustedPublishing || this.context.parameters.changesetVersion?.useTrustedPublishing);
+  }
+  /**
+   * True when publish should use npm Trusted Publishing (OIDC) instead of NPM_TOKEN.
+   */
+  isTrustedPublishingEnv() {
+    if (this.useTrustedPublishing) {
+      return true;
+    }
+    const envFlag = this.context.getEnv("FE_RELEASE_TRUSTED_PUBLISHING");
+    if (envFlag === "1" || envFlag === "true") {
+      return true;
+    }
+    return Boolean(this.context.getEnv("ACTIONS_ID_TOKEN_REQUEST_URL"));
+  }
   shouldProcessWorkspace(workspace) {
     return shouldProcessWorkspace(workspace, this.ignoreNonUpdatedPackages);
   }
@@ -1631,15 +1647,26 @@ var ChangesetVersion = class extends import_scripts_context4.ScriptPlugin {
     }
   }
   /**
-   * Ensure NPM_TOKEN is available and configured before changeset publish.
+   * Configure npm auth before changeset publish.
    *
-   * Only required for `publish` / `both` modes. Version-only runs (release PR)
-   * do not need an npm auth token.
+   * Uses Trusted Publishing (OIDC) when detected; otherwise requires `NPM_TOKEN`.
+   * Version-only runs (release PR) do not need npm auth.
    */
   async validateNpmToken() {
+    if (this.isTrustedPublishingEnv()) {
+      this.logger.info(
+        "Using npm Trusted Publishing (OIDC); skip NPM_TOKEN auth setup"
+      );
+      if (this.context.dryRun) {
+        this.logDryRun("Would publish via npm Trusted Publishing (OIDC)");
+      }
+      return;
+    }
     const npmToken = this.context.getEnv("NPM_TOKEN");
     if (!npmToken) {
-      throw new Error("NPM_TOKEN is not set");
+      throw new Error(
+        "NPM_TOKEN is not set. Enable Trusted Publishing (OIDC) or provide NPM_TOKEN."
+      );
     }
     if (this.context.dryRun) {
       this.logDryRun(
@@ -3982,6 +4009,9 @@ function programArgs() {
   ).option(
     "--changelog.ignore-non-updated-packages",
     "Alias of --changesetVersion.ignore-non-updated-packages"
+  ).option(
+    "--changesetVersion.use-trusted-publishing",
+    "Use npm Trusted Publishing (OIDC) instead of NPM_TOKEN (fe-config: release.changesetVersion.useTrustedPublishing)"
   ).option(
     "--changesetVersion.mode <mode>",
     "ChangesetVersion mode: version (default), publish, or both (fe-config: release.changesetVersion.mode)",

package/dist/cli.js

@@ -5,7 +5,7 @@ import { Command } from "commander";
 
 // package.json
 var description = "A tool for releasing front-end projects, supporting multiple release modes and configurations, simplifying the release process and improving efficiency.";
-var version = "5.1.0";
+var version = "5.3.2";
 
 // src/cli.ts
 import semver from "semver";
@@ -1590,6 +1590,22 @@ var ChangesetVersion = class extends ScriptPlugin2 {
   get ignoreNonUpdatedPackages() {
     return !!this.config.ignoreNonUpdatedPackages;
   }
+  get useTrustedPublishing() {
+    return !!(this.config.useTrustedPublishing || this.context.parameters.changesetVersion?.useTrustedPublishing);
+  }
+  /**
+   * True when publish should use npm Trusted Publishing (OIDC) instead of NPM_TOKEN.
+   */
+  isTrustedPublishingEnv() {
+    if (this.useTrustedPublishing) {
+      return true;
+    }
+    const envFlag = this.context.getEnv("FE_RELEASE_TRUSTED_PUBLISHING");
+    if (envFlag === "1" || envFlag === "true") {
+      return true;
+    }
+    return Boolean(this.context.getEnv("ACTIONS_ID_TOKEN_REQUEST_URL"));
+  }
   shouldProcessWorkspace(workspace) {
     return shouldProcessWorkspace(workspace, this.ignoreNonUpdatedPackages);
   }
@@ -1611,15 +1627,26 @@ var ChangesetVersion = class extends ScriptPlugin2 {
     }
   }
   /**
-   * Ensure NPM_TOKEN is available and configured before changeset publish.
+   * Configure npm auth before changeset publish.
    *
-   * Only required for `publish` / `both` modes. Version-only runs (release PR)
-   * do not need an npm auth token.
+   * Uses Trusted Publishing (OIDC) when detected; otherwise requires `NPM_TOKEN`.
+   * Version-only runs (release PR) do not need npm auth.
    */
   async validateNpmToken() {
+    if (this.isTrustedPublishingEnv()) {
+      this.logger.info(
+        "Using npm Trusted Publishing (OIDC); skip NPM_TOKEN auth setup"
+      );
+      if (this.context.dryRun) {
+        this.logDryRun("Would publish via npm Trusted Publishing (OIDC)");
+      }
+      return;
+    }
     const npmToken = this.context.getEnv("NPM_TOKEN");
     if (!npmToken) {
-      throw new Error("NPM_TOKEN is not set");
+      throw new Error(
+        "NPM_TOKEN is not set. Enable Trusted Publishing (OIDC) or provide NPM_TOKEN."
+      );
     }
     if (this.context.dryRun) {
       this.logDryRun(
@@ -3962,6 +3989,9 @@ function programArgs() {
   ).option(
     "--changelog.ignore-non-updated-packages",
     "Alias of --changesetVersion.ignore-non-updated-packages"
+  ).option(
+    "--changesetVersion.use-trusted-publishing",
+    "Use npm Trusted Publishing (OIDC) instead of NPM_TOKEN (fe-config: release.changesetVersion.useTrustedPublishing)"
   ).option(
     "--changesetVersion.mode <mode>",
     "ChangesetVersion mode: version (default), publish, or both (fe-config: release.changesetVersion.mode)",

package/dist/index.cjs

@@ -1615,6 +1615,22 @@ var ChangesetVersion = class extends import_scripts_context4.ScriptPlugin {
   get ignoreNonUpdatedPackages() {
     return !!this.config.ignoreNonUpdatedPackages;
   }
+  get useTrustedPublishing() {
+    return !!(this.config.useTrustedPublishing || this.context.parameters.changesetVersion?.useTrustedPublishing);
+  }
+  /**
+   * True when publish should use npm Trusted Publishing (OIDC) instead of NPM_TOKEN.
+   */
+  isTrustedPublishingEnv() {
+    if (this.useTrustedPublishing) {
+      return true;
+    }
+    const envFlag = this.context.getEnv("FE_RELEASE_TRUSTED_PUBLISHING");
+    if (envFlag === "1" || envFlag === "true") {
+      return true;
+    }
+    return Boolean(this.context.getEnv("ACTIONS_ID_TOKEN_REQUEST_URL"));
+  }
   shouldProcessWorkspace(workspace) {
     return shouldProcessWorkspace(workspace, this.ignoreNonUpdatedPackages);
   }
@@ -1636,15 +1652,26 @@ var ChangesetVersion = class extends import_scripts_context4.ScriptPlugin {
     }
   }
   /**
-   * Ensure NPM_TOKEN is available and configured before changeset publish.
+   * Configure npm auth before changeset publish.
    *
-   * Only required for `publish` / `both` modes. Version-only runs (release PR)
-   * do not need an npm auth token.
+   * Uses Trusted Publishing (OIDC) when detected; otherwise requires `NPM_TOKEN`.
+   * Version-only runs (release PR) do not need npm auth.
    */
   async validateNpmToken() {
+    if (this.isTrustedPublishingEnv()) {
+      this.logger.info(
+        "Using npm Trusted Publishing (OIDC); skip NPM_TOKEN auth setup"
+      );
+      if (this.context.dryRun) {
+        this.logDryRun("Would publish via npm Trusted Publishing (OIDC)");
+      }
+      return;
+    }
     const npmToken = this.context.getEnv("NPM_TOKEN");
     if (!npmToken) {
-      throw new Error("NPM_TOKEN is not set");
+      throw new Error(
+        "NPM_TOKEN is not set. Enable Trusted Publishing (OIDC) or provide NPM_TOKEN."
+      );
     }
     if (this.context.dryRun) {
       this.logDryRun(

package/dist/index.d.ts

@@ -881,7 +881,8 @@ interface ChangeLogInterface {
  * Changesets CLI for monorepo version bumps.
  *
  * Pipeline phases:
- * - **onBefore**: validate `.changeset` directory; validate `NPM_TOKEN` when mode includes publish
+ * - **onBefore**: validate `.changeset` directory; configure npm auth when mode includes publish
+ *   (`NPM_TOKEN` for token auth, or skip when Trusted Publishing / OIDC is detected)
  * - **onExec**: generate per-workspace git changelogs (skips `dependencyRelease`
  *   when `ignoreNonUpdatedPackages` is enabled)
  * - **onSuccess**: run version and/or publish flow based on `mode`
@@ -994,6 +995,17 @@ interface ChangesetVersionProps extends GitChangelogOptions, ScriptPluginProps {
      * @default false
      */
     ignoreNonUpdatedPackages?: boolean;
+    /**
+     * Use npm Trusted Publishing (OIDC) instead of `NPM_TOKEN`.
+     *
+     * When enabled (or when GitHub Actions OIDC env is detected), publish skips
+     * writing `_authToken` to npm config so the CLI can exchange OIDC credentials.
+     *
+     * CLI: `--changesetVersion.use-trusted-publishing`
+     *
+     * @default false
+     */
+    useTrustedPublishing?: boolean;
 }
 /**
  * Manages changelog generation, changeset file creation, and Changesets CLI execution.
@@ -1008,14 +1020,19 @@ declare class ChangesetVersion extends ScriptPlugin<ReleaseContext, ChangesetVer
     get changesetConfigPath(): string;
     protected get mode(): ChangesetVersionMode;
     protected get ignoreNonUpdatedPackages(): boolean;
+    protected get useTrustedPublishing(): boolean;
+    /**
+     * True when publish should use npm Trusted Publishing (OIDC) instead of NPM_TOKEN.
+     */
+    protected isTrustedPublishingEnv(): boolean;
     protected shouldProcessWorkspace(workspace: WorkspaceInterface): boolean;
     protected getProcessableWorkspaces(workspaces: WorkspaceInterface[]): WorkspaceInterface[];
     onBefore(): Promise<void>;
     /**
-     * Ensure NPM_TOKEN is available and configured before changeset publish.
+     * Configure npm auth before changeset publish.
      *
-     * Only required for `publish` / `both` modes. Version-only runs (release PR)
-     * do not need an npm auth token.
+     * Uses Trusted Publishing (OIDC) when detected; otherwise requires `NPM_TOKEN`.
+     * Version-only runs (release PR) do not need npm auth.
      */
     protected validateNpmToken(): Promise<void>;
     onExec(_context: ReleaseContext): Promise<void>;

package/dist/index.js

@@ -1566,6 +1566,22 @@ var ChangesetVersion = class extends ScriptPlugin2 {
   get ignoreNonUpdatedPackages() {
     return !!this.config.ignoreNonUpdatedPackages;
   }
+  get useTrustedPublishing() {
+    return !!(this.config.useTrustedPublishing || this.context.parameters.changesetVersion?.useTrustedPublishing);
+  }
+  /**
+   * True when publish should use npm Trusted Publishing (OIDC) instead of NPM_TOKEN.
+   */
+  isTrustedPublishingEnv() {
+    if (this.useTrustedPublishing) {
+      return true;
+    }
+    const envFlag = this.context.getEnv("FE_RELEASE_TRUSTED_PUBLISHING");
+    if (envFlag === "1" || envFlag === "true") {
+      return true;
+    }
+    return Boolean(this.context.getEnv("ACTIONS_ID_TOKEN_REQUEST_URL"));
+  }
   shouldProcessWorkspace(workspace) {
     return shouldProcessWorkspace(workspace, this.ignoreNonUpdatedPackages);
   }
@@ -1587,15 +1603,26 @@ var ChangesetVersion = class extends ScriptPlugin2 {
     }
   }
   /**
-   * Ensure NPM_TOKEN is available and configured before changeset publish.
+   * Configure npm auth before changeset publish.
    *
-   * Only required for `publish` / `both` modes. Version-only runs (release PR)
-   * do not need an npm auth token.
+   * Uses Trusted Publishing (OIDC) when detected; otherwise requires `NPM_TOKEN`.
+   * Version-only runs (release PR) do not need npm auth.
    */
   async validateNpmToken() {
+    if (this.isTrustedPublishingEnv()) {
+      this.logger.info(
+        "Using npm Trusted Publishing (OIDC); skip NPM_TOKEN auth setup"
+      );
+      if (this.context.dryRun) {
+        this.logDryRun("Would publish via npm Trusted Publishing (OIDC)");
+      }
+      return;
+    }
     const npmToken = this.context.getEnv("NPM_TOKEN");
     if (!npmToken) {
-      throw new Error("NPM_TOKEN is not set");
+      throw new Error(
+        "NPM_TOKEN is not set. Enable Trusted Publishing (OIDC) or provide NPM_TOKEN."
+      );
     }
     if (this.context.dryRun) {
       this.logDryRun(

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@qlover/fe-release",
   "description": "A tool for releasing front-end projects, supporting multiple release modes and configurations, simplifying the release process and improving efficiency.",
-  "version": "5.1.0",
+  "version": "5.3.2",
   "type": "module",
   "private": false,
   "homepage": "https://github.com/qlover/fe-base/tree/master/packages/fe-release",
@@ -52,17 +52,17 @@
     "@changesets/get-dependents-graph": "^2.1.4",
     "@manypkg/get-packages": "^1.1.3",
     "@octokit/rest": "^21.0.2",
-    "commander": "^11.0.0",
+    "commander": "^11.1.0",
     "find-workspaces": "^0.3.1",
     "git-url-parse": "^16.1.0",
     "gitlog": "^5.1.0",
-    "lodash-es": "^4.17.22",
+    "lodash-es": "^4.18.1",
     "p-limit": "^6.2.0",
-    "semver": "^7.5.4",
-    "@qlover/env-loader": "1.0.2",
-    "@qlover/fe-corekit": "3.4.4",
+    "semver": "^7.8.5",
+    "@qlover/env-loader": "1.1.1",
+    "@qlover/fe-corekit": "3.4.7",
     "@qlover/logger": "1.2.1",
-    "@qlover/scripts-context": "2.3.3"
+    "@qlover/scripts-context": "2.3.4"
   },
   "scripts": {
     "lint": "eslint src --fix",