Add top-level OIDC permissions to publish workflow

Co-authored-by: Ona <no-reply@ona.com>
Use bunx npm publish for trusted publishing (#6 )
2026-03-21 12:21:17 +00:00 · 2026-03-14 01:23:05 +00:00 · 2026-03-14 01:19:35 +00:00 · 2026-03-14 01:11:45 +00:00
1 changed files with 5 additions and 1 deletions
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,10 @@ on:
  release:
    types: [published]

+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 jobs:
  publish:
    runs-on: ubuntu-latest
@@ -21,6 +25,6 @@ jobs:

      - run: bun test

-      - run: bun publish --access public --provenance
+      - run: bunx npm publish --provenance --access public
        env:
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org