From 8eb747663abb7abf31a1426493a7096a82355b0a Mon Sep 17 00:00:00 2001 From: Tim van der Meij Date: Fri, 28 Nov 2025 21:01:13 +0100 Subject: [PATCH] Use OIDC trusted publishing in the GitHub Actions release workflow This commit updates the release pipeline to use OIDC trusted publishing now that we have configured it between GitHub Actions and NPM. This solution allows us to remove the token variable (because there is no longer a fixed token) and provenance flag (because provenance attestations are generated by default with this approach); refer to https://docs.npmjs.com/trusted-publishers for more information. --- .github/workflows/publish_release.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/publish_release.yml b/.github/workflows/publish_release.yml index 9a19b378b..ea903e1fb 100644 --- a/.github/workflows/publish_release.yml +++ b/.github/workflows/publish_release.yml @@ -34,6 +34,4 @@ jobs: run: npx gulp dist - name: Publish the `pdfjs-dist` library to NPM - run: npm publish ./build/dist --provenance - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + run: npm publish ./build/dist