feat: enable npm provenance with OIDC and Node 24 for semantic-release#413
Merged
Jamie-BitFlight merged 2 commits intomainfrom Nov 5, 2025
Conversation
- Add Node 24 setup for semantic-release (satisfies v25.0.1 requirement: ^22.14.0 || >= 24.10.0) - Enable npm provenance with OIDC authentication (no manual token needed) - Remove NPM_TOKEN and NODE_AUTH_TOKEN from workflow (OIDC handles auth automatically) - Configure @semantic-release/npm with provenance: true for attestation How it works: - Workflow has id-token: write permission for OIDC - npm CLI detects provenance: true in package.json - npm automatically exchanges GitHub OIDC token for npm authentication - Package published with provenance attestation
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…CUpBbScMduUTctqgM3pYN
Contributor
Coverage Report
File CoverageNo changed files found. |
Jamie-BitFlight
deleted the
claude/fix-semantic-release-node-version-011CUpBbScMduUTctqgM3pYN
branch
Jamie-BitFlight
pushed a commit
that referenced
this pull request
Nov 5, 2025
# [1.9.0](v1.8.0...v1.9.0) (2025-11-05) ### Bug Fixes * add division by zero check and improve diff error handling ([cc937f9](cc937f9)) * add integration test and resolve linting issues ([9e8993a](9e8993a)), closes [#335](#335) [#335](#335) * apply linting and formatting fixes ([a4392aa](a4392aa)) * correct lint:eslint:fix script and apply auto-fixes ([fa7bcee](fa7bcee)) * remove match regex from nconf env config to enable INPUT_ var transformation ([b61f097](b61f097)) * update nconf import for CommonJS/ESM compatibility ([#409](#409)) ([1878c34](1878c34)) * use Node 24 for semantic-release to satisfy version requirement ([529a2d2](529a2d2)) * use Node 24 for semantic-release to satisfy version requirement ([5e0acc4](5e0acc4)) * use sanitized artifact names to avoid special characters ([f64a248](f64a248)) ### Features * add integration test workflow for real-world repositories ([ca961e5](ca961e5)) * add matrix testing for Node.js 20.x and 24.x versions ([aa4ee85](aa4ee85)) * add Value column to outputs table and pre-commit hook documentation ([81a096d](81a096d)) * enable npm provenance for automated publishing without manual token ([b2484cf](b2484cf)) * enable npm provenance with OIDC and Node 24 for semantic-release ([#413](#413)) ([c526aae](c526aae))
Jamie-BitFlight
pushed a commit
that referenced
this pull request
Nov 5, 2025
# [1.8.0](v1.7.2...v1.8.0) (2025-11-05) ### Bug Fixes * add 'vibes' to contributions for Jamie Nelson ([#414](#414)) ([684c155](684c155)) * add division by zero check and improve diff error handling ([cc937f9](cc937f9)) * add integration test and resolve linting issues ([9e8993a](9e8993a)), closes [#335](#335) [#335](#335) * apply linting and formatting fixes ([a4392aa](a4392aa)) * correct lint:eslint:fix script and apply auto-fixes ([fa7bcee](fa7bcee)) * **defaults:** fix npm release blockage ([34e2f46](34e2f46)) * remove match regex from nconf env config to enable INPUT_ var transformation ([b61f097](b61f097)) * update nconf import for CommonJS/ESM compatibility ([#409](#409)) ([1878c34](1878c34)) * use Node 24 for semantic-release to satisfy version requirement ([529a2d2](529a2d2)) * use Node 24 for semantic-release to satisfy version requirement ([5e0acc4](5e0acc4)) * use sanitized artifact names to avoid special characters ([f64a248](f64a248)) ### Features * add integration test workflow for real-world repositories ([ca961e5](ca961e5)) * add matrix testing for Node.js 20.x and 24.x versions ([aa4ee85](aa4ee85)) * add Value column to outputs table and pre-commit hook documentation ([81a096d](81a096d)) * enable npm provenance for automated publishing without manual token ([b2484cf](b2484cf)) * enable npm provenance with OIDC and Node 24 for semantic-release ([#413](#413)) ([c526aae](c526aae)) * **refactor:** JSDocs added, Unit Tests added using ViTest, refactored for maintainability ([#239](#239)) ([0451f2c](0451f2c))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
How it works:
Description
Type of Change
Related Issues
Changes Made
Testing
Checklist
Screenshots (if applicable)
Additional Notes