mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-13 18:32:12 +03:00
226538fa27
* feat(ci): publish to npm through Trusted Publishing (OIDC) by default npm rejects provenance from self-hosted runners and is retiring tokens that bypass 2FA; v3.8.49 answered with staged publishing (WS1.3) so a leaked token could never publish alone — at the price of a manual `npm stage approve` per release. Trusted Publishing gives the same guarantee with no token at all: the github-hosted stage-npm job exchanges GitHub's id-token for a credential scoped to that run, provenance included, and the flow is automatic again as it was up to v3.8.48. publish_mode gains `auto` (the default, also the path for the release event); `staged` now runs only when asked for; `direct` stays as the emergency token fallback. Until the owner registers the Trusted Publisher on npmjs.com (diegosouzapw/OmniRoute, workflow npm-publish.yml) the automatic step fails with ENEEDAUTH and either other mode can be dispatched — documented in docs/ops/RELEASE_CHECKLIST.md. * docs(release): date the checklist for the Trusted Publishing change and drop the env-var claim check-deprecated-versions flags a touched doc whose header still says 2026-06-28 / v3.8.40; the fabricated-docs gate read the backticked NPM_TOKEN as an environment variable the code never reads (it is a repository secret).