Session 0A6pbuvxE5Ui

I'll search for all the relevant OIDC/npm trusted publishing configuration details across the repository. Let me run multiple searches in parallel.

Now let me read the full workflow files to get complete context.

Now let me check for a Craft configuration file (.craft.yml) and the root package.json for any publish-related config.

Here is a comprehensive summary of the npm OIDC trusted publishing setup in the BYK/superset repository.

Overview

The repository uses Sentry's Craft (v2) as the release tool, combined with npm OIDC trusted publishing to publish packages to npm without storing npm tokens as secrets. This is a tokenless publish flow, relying on GitHub Actions' OIDC identity provider to authenticate directly with the npm registry.

Key Files and Configuration

1. /home/byk/Code/superset/.github/workflows/publish.yml (the publish workflow)

Trigger: The workflow runs when an issue receives the accepted label (Craft v2 pattern).

OIDC-relevant configuration:

• id-token: write permission (line 14): This is the critical permission that allows the GitHub Actions runner to request an OIDC token from GitHub's token endpoint. npm uses this token to verify the publish request came from a trusted GitHub Actions workflow.

• environment: production (line 11): The job runs in the production GitHub environment, which is where APP_ID (variable) and APP_PRIVATE_KEY (secret) are stored for the Craft GitHub App token.

• Node.js version: 22 (line 50): Uses actions/setup-node@v4 with Node 22.

• npm upgrade step (lines 52-55):

  - name: Upgrade npm for OIDC trusted publishing
    run: |
      npm install -g npm@latest
      npm --version
  

  This upgrades npm to the latest version globally. This is necessary because OIDC trusted publishing support in npm requires a relatively recent version (npm 9.5.0+ for provenance, and newer versions for full OIDC token exchange). The npm bundled with Node 22 may not be new enough, so it is explicitly upgraded.

• Craft publishes (line 65): craft publish is invoked with the parsed version. Craft handles the actual npm publish call.

2. /home/byk/Code/superset/.craft.yml (Craft configuration)

minVersion: '2.21.1'
changelog:
  policy: auto
versioning:
 ...