Skip to content

Enables OIDC for NPM package publishing - #61

Open
harshitha-cstk wants to merge 1 commit into
masterfrom
chore/npm-trusted-publishing
Open

Enables OIDC for NPM package publishing#61
harshitha-cstk wants to merge 1 commit into
masterfrom
chore/npm-trusted-publishing

Conversation

@harshitha-cstk

Copy link
Copy Markdown
Contributor

Updates the release workflow to use npm Trusted Publishing (OpenID Connect) for authenticating with the NPM registry. This enhances security by removing the dependency on a long-lived NPM_TOKEN secret.

The change involves adding id-token: write permissions to the workflow and ensuring the latest npm version is installed, which is a prerequisite for Trusted Publishing.

Updates the release workflow to use npm Trusted Publishing (OpenID Connect) for authenticating with the NPM registry. This enhances security by removing the dependency on a long-lived `NPM_TOKEN` secret.
The change involves adding `id-token: write` permissions to the workflow and ensuring the latest npm version is installed, which is a prerequisite for Trusted Publishing.
@harshitha-cstk
harshitha-cstk requested a review from a team as a code ownerMay 29, 2026 07:15
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check TypeCount (with fixes)Without fixesThresholdResult
🔴 Critical Severity0010✅ Passed
🟠 High Severity0025✅ Passed
🟡 Medium Severity00500✅ Passed
🔵 Low Severity001000✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

SeverityBreaches (with fixes)Breaches (no fixes)SLA Threshold (with/no fixes)Status
🔴 Critical0015 / 30 days✅ Passed
🟠 High0030 / 120 days✅ Passed
🟡 Medium0090 / 365 days✅ Passed
🔵 Low00180 / 365 days✅ Passed

✅ BUILD PASSED - All security checks passed

@snyk-io

snyk-ioBot commented Aug 11, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

StatusScan Engine Critical High Medium LowTotal (0)
Open Source Security0000 0 issues
Licenses0000 0 issues
Code Security0000 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check TypeCount (with fixes)Without fixesThresholdResult
🔴 Critical Severity0010✅ Passed
🟠 High Severity0025✅ Passed
🟡 Medium Severity00500✅ Passed
🔵 Low Severity001000✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

SeverityBreaches (with fixes)Breaches (no fixes)SLA Threshold (with/no fixes)Status
🔴 Critical0015 / 30 days✅ Passed
🟠 High0030 / 120 days✅ Passed
🟡 Medium0090 / 365 days✅ Passed
🔵 Low00180 / 365 days✅ Passed

✅ BUILD PASSED - All security checks passed

1 similar comment
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check TypeCount (with fixes)Without fixesThresholdResult
🔴 Critical Severity0010✅ Passed
🟠 High Severity0025✅ Passed
🟡 Medium Severity00500✅ Passed
🔵 Low Severity001000✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

SeverityBreaches (with fixes)Breaches (no fixes)SLA Threshold (with/no fixes)Status
🔴 Critical0015 / 30 days✅ Passed
🟠 High0030 / 120 days✅ Passed
🟡 Medium0090 / 365 days✅ Passed
🔵 Low00180 / 365 days✅ Passed

✅ BUILD PASSED - All security checks passed

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@harshitha-cstk@netrajpatel@sunil-lakshman@naman-contentstack