From c1877bfaf40b48556e89e6d5f188799b92aa612e Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 2 Jun 2026 03:08:16 +0000 Subject: [PATCH] Add npm release workflow via OIDC trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Publishes @pasteapp/mcp on GitHub Release using npm Trusted Publishing (keyless OIDC) with build provenance — no NPM_TOKEN secret required. --- .github/workflows/release.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..9e5a541 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,26 @@ +name: Release + +on: + release: + types: [published] + +permissions: + contents: read + id-token: write # required for npm provenance via OIDC trusted publishing + +jobs: + publish: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: '20' + registry-url: 'https://registry.npmjs.org' + cache: npm + # Trusted Publishing (keyless OIDC) requires npm >= 11.5.1 + - run: npm install -g npm@latest + - run: npm ci + - run: npm run build + - run: npm test + - run: npm publish --provenance --access public