From a718ca255235453278740691239c7da2472dbdff Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Tue, 3 Mar 2026 21:49:54 +0100 Subject: [PATCH 1/2] fix(ci): use npm trusted publishing (OIDC) instead of secret tokens Replace NPM_TOKEN-based authentication with OIDC trusted publishing for both release workflows, improving supply chain security. - release-binaries.yml: add id-token: write, use --provenance, remove NODE_AUTH_TOKEN - release.yml: remove npm-token input, add NPM_CONFIG_PROVENANCE env var Co-Authored-By: Claude Opus 4.6 --- .github/workflows/release-binaries.yml | 5 ++--- .github/workflows/release.yml | 3 ++- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml index c56a1048..08854061 100644 --- a/.github/workflows/release-binaries.yml +++ b/.github/workflows/release-binaries.yml @@ -11,6 +11,7 @@ on: permissions: contents: read + id-token: write jobs: build-and-publish: @@ -82,6 +83,4 @@ jobs: registry-url: "https://registry.npmjs.org" - name: Publish platform package - run: npm publish ./packages/${{ matrix.artifact }} --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + run: npm publish ./packages/${{ matrix.artifact }} --access public --provenance diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4e07f2e1..43d0bc85 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -134,7 +134,8 @@ jobs: workflow: release github-token: ${{ steps.generate_token.outputs.token }} branch: release - npm-token: ${{ secrets.NPM_TOKEN }} + env: + NPM_CONFIG_PROVENANCE: "true" - name: Save Bun Cache uses: actions/cache/save@v4 if: steps.validate.outcome == 'success' && steps.restore-bun-cache.outputs.cache-hit != 'true' From 2a72cc0ba72d6cac8d0802bd3427d75253f02183 Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Tue, 3 Mar 2026 21:49:58 +0100 Subject: [PATCH 2/2] chore: add .mcp.json to .gitignore Prevent local MCP server config from being committed to the repo. Co-Authored-By: Claude Opus 4.6 --- .gitignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitignore b/.gitignore index b75e8253..07aa9d0c 100644 --- a/.gitignore +++ b/.gitignore @@ -20,6 +20,9 @@ coverage # OS files .DS_Store +# Local MCP config +.mcp.json + # Proto / Moon .moon/cache .moon/docker