Skip to content

SDK - Migrate to OIDC Trusted Publisher for NPM publishing #1648

@MantisClone

Description

@MantisClone

Problem

The requestNetwork SDK currently uses long-lived NPM tokens (circleci-requestNetwork) for package publishing. This poses security risks if tokens are compromised or exposed, and doesn't align with NPM's new security recommendations for token management.

Proposed Solution

Migrate from long-lived tokens to OIDC Trusted Publisher authentication:

  • Configure trusted publishers on npmjs.com for all @RequestNetwork SDK packages
  • Update CircleCI configuration to use OIDC authentication
  • Remove long-lived circleci-requestNetwork token after successful migration

Considerations

  • Blocker: CircleCI doesn't currently support OIDC/Trusted Publishers for NPM
  • Alternative: Consider migrating CI/CD from CircleCI to GitHub Actions (which supports OIDC)
  • Interim: Continue using granular access tokens with 90-day expiration when NPM enforces the restriction
  • Impact: Approximately 20+ packages published from this repository would need updated publisher configuration

Related: web-components (RequestNetwork/web-components#345) and request-cli (RequestNetwork/request-cli#13) already migrated to OIDC using GitHub Actions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    Status

    🆕 New

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions