From 86edc849e9cb87c059b9a0e802c852da974e9994 Mon Sep 17 00:00:00 2001 From: Arthurk12 Date: Mon, 26 Oct 2026 18:25:36 -0300 Subject: [PATCH] ci: stage npm releases instead of publishing them directly The publish workflow pushes each release straight to the registry with `npm publish`, so a version goes public with no maintainer proof-of-presence (2FA) at any point. Use `npm stage publish`, the flow npm recommends for automated pipelines: the workflow uploads the package in a staged state and a maintainer approves it with 2FA (`npm stage approve`) before it becomes public. Provenance and the OIDC trusted-publishing setup are kept as is. --- .github/workflows/publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b3cae4b..af40063 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -34,6 +34,6 @@ jobs: - name: Build run: npm run build --if-present - - name: Publish to NPM - run: npm publish --provenance --access public + - name: Stage package on NPM + run: npm stage publish --provenance --access public