Remove npm token from workflow and Apply OIDC to publish packages (#647)

irrationnelle · web-flow · commit b0bbf6cf8a3b · 2025-11-04T18:25:39.000+09:00
diff --git a/.changeset/gold-ideas-burn.md b/.changeset/gold-ideas-burn.md
@@ -0,0 +1,2 @@
+---
+---
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -12,6 +12,10 @@ jobs:
   release:
     name: Create PR or release packages
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -69,7 +73,6 @@ jobs:
           publish: yarn changeset publish
           version: yarn changeset:version
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.DAANGNBOT_PAT }}
 
       - name: Continuous release via pkg.pr.new
diff --git a/config/package.json b/config/package.json
@@ -38,7 +38,8 @@
     "ultra-runner": "^3.10.5"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/core/package.json b/core/package.json
@@ -56,7 +56,8 @@
     "ultra-runner": "^3.10.5"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/compat-await-push/package.json b/extensions/compat-await-push/package.json
@@ -47,7 +47,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/link/package.json b/extensions/link/package.json
@@ -63,7 +63,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-basic-ui/package.json b/extensions/plugin-basic-ui/package.json
@@ -56,7 +56,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-devtools/package.json b/extensions/plugin-devtools/package.json
@@ -41,7 +41,8 @@
     "@stackflow/core": "^1.1.0-canary.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-google-analytics-4/package.json b/extensions/plugin-google-analytics-4/package.json
@@ -51,7 +51,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-history-sync/package.json b/extensions/plugin-history-sync/package.json
@@ -88,7 +88,8 @@
     "eagerEsModules": true
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-map-initial-activity/package.json b/extensions/plugin-map-initial-activity/package.json
@@ -43,7 +43,8 @@
     "@stackflow/react": "^1.3.2-canary.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-preload/package.json b/extensions/plugin-preload/package.json
@@ -49,7 +49,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-renderer-basic/package.json b/extensions/plugin-renderer-basic/package.json
@@ -47,7 +47,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-renderer-web/package.json b/extensions/plugin-renderer-web/package.json
@@ -47,7 +47,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/plugin-stack-depth-change/package.json b/extensions/plugin-stack-depth-change/package.json
@@ -42,7 +42,8 @@
     "@stackflow/core": "^1.1.0-canary.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/extensions/react-ui-core/package.json b/extensions/react-ui-core/package.json
@@ -48,7 +48,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/integrations/react/package.json b/integrations/react/package.json
@@ -61,7 +61,8 @@
     "react": ">=16.8.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "ultra": {
     "concurrent": [
diff --git a/packages/esbuild-config/package.json b/packages/esbuild-config/package.json
@@ -15,6 +15,7 @@
     "@vanilla-extract/esbuild-plugin": "^2.3.8"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }
