Skip to content

Enable releasing through OIDC#65

Merged
szegedi merged 1 commit intomainfrom
szegedi/oidc
Feb 12, 2026
Merged

Enable releasing through OIDC#65
szegedi merged 1 commit intomainfrom
szegedi/oidc

Conversation

@szegedi
Copy link
Copy Markdown
Contributor

@szegedi szegedi commented Feb 12, 2026

What does this PR do?:

  • Updates release.yml so it works well with OIDC release method.

Motivation:
Npm no longer allows releasing with broad tokens. It still allows releasing with granular tokens, but their lifetime is limited now. This all makes releasing while authenticating with tokens painful. OIDC provides a much better way to release the packages, and will be the preferred way going forward.

OIDC needs to be enabled for this repo in the Npm settings – I just did that. After that, publishing is rather simple, it no longer requires a token, but rather depends on GitHub proving to Npm that the release request came from a GH action as configured (we need to specify the organization, repo name, filename with the release action, and the release environment in the NPM configuration.)

Additional Notes:
Node.js 24 is used explicitly for releasing so we have a recent version of npm CLI. The token is removed from the release, the only thing required for OIDC to work from the GH side is a write permission to id-token in the action.

Jira: PROF-12794

@github-actions
Copy link
Copy Markdown

Overall package size

Self size: 37 MB
Deduped: 37 MB
No deduping: 37 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------|

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@szegedi szegedi merged commit f8b339b into main Feb 12, 2026
50 checks passed
gyuheon0h pushed a commit that referenced this pull request Feb 12, 2026
@gyuheon0h gyuheon0h mentioned this pull request Feb 12, 2026
gyuheon0h added a commit that referenced this pull request Feb 12, 2026
* Add CODEOWNERS (#64)

* Add CODEOWNERS, with dd-trace-js and libdatadog teams

* Enable releasing through OIDC (#65)

* Bump libdd-crashtracker to v27.0.0 (#66)

* v0.8.1

---------

Co-authored-by: Attila Szegedi <szegedi@users.noreply.github.com>
gyuheon0h pushed a commit that referenced this pull request Mar 3, 2026
@gyuheon0h gyuheon0h mentioned this pull request Mar 3, 2026
gyuheon0h pushed a commit that referenced this pull request Mar 3, 2026
gyuheon0h pushed a commit that referenced this pull request Mar 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants