-
|
Hello npm community! 👋 We're excited to announce that we're bringing OpenID Connect (OIDC) authentication to the npm registry! This new feature will enable more secure, token-less authentication for publishing packages in your CI/CD workflows. What's Coming?OIDC support will allow you to publish npm packages from your CI/CD workflows without managing npm tokens. Your CI/CD provider's identity tokens will authenticate directly with the npm registry, providing:
Initial Platform SupportAt launch, we'll support package publishing from:
We plan to expand support to additional platforms based on community feedback and demand. Timeline
Get Involved!We want to hear from you! This thread is your space to:
Interested in the Private Preview?If you'd like to be considered for the private preview in June, please comment below with:
Stay UpdatedWe'll use this thread to share updates, documentation links, and gather feedback throughout the rollout. Make sure to watch this discussion to stay informed! Looking forward to your feedback and building this together with the community! 🎉 The npm Team at GitHub |
Beta Was this translation helpful? Give feedback.
Replies: 12 comments 5 replies
-
|
Super excited for OIDC support on npm! We at Arcjet would love to be part of the private preview in June.
We publish the arcjet-js SDK to npm but don't currently use CI publishing due to security concerns around long-lived tokens. We also want to add build provenance which is easiest using CI publishing.
GitHub Actions.
I think we're up to 33 packages now. We generally publish once or twice per month. |
Beta Was this translation helpful? Give feedback.
-
|
Just cosigning to say that strengthening the chain of custody and also improving Arcjet's ability to automate more steps of the publishing process would be extremely useful in making it easier for us to deploy more often and with greater confidence. |
Beta Was this translation helpful? Give feedback.
-
we'd love to be involved in the preview so we can make sure semantic-release is ready for the public release.
|
Beta Was this translation helpful? Give feedback.
-
|
from a testing perspective, https://www.npmjs.com/org/form8ion has 87 packages that are often published more often than our official semantic-release packages, so it could be helpful to also include that org so we could evaluate semantic-release changes on active packages before a stable release |
Beta Was this translation helpful? Give feedback.
-
out of curiosity, is supporting OIDC for other registries, like Artifactory, part of the plan? |
Beta Was this translation helpful? Give feedback.
-
|
We don't have specific plans for other registries at this moment. It seems like most of the support for other registries could be done directly on the cli once our public PR is ready. |
Beta Was this translation helpful? Give feedback.
-
🙋 Yay! Express interest in joining the private preview
|
Beta Was this translation helpful? Give feedback.
-
|
I would be interested as well in the preview if you need additional tokens
|
Beta Was this translation helpful? Give feedback.
-
|
Please add Azure DevOps to the shortlist of supported CI/CD platforms. 🙏 |
Beta Was this translation helpful? Give feedback.
-
|
Will this include using OIDC for fetching/resolving packages from the registry via OIDC? Or just publishing? If just publishing, do you plan to support OIDC for |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
How do you identify which npm package is allowed to be published by what repo (fork are not allowed to, right?) How do you prevent malicious command injection in a workflow crafting a directory with malware and running |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
This is great! Will there be a way to restrict packages so that they can only be published through OIDC? That way, even if a maintainer's npm token is compromised, an attacker won't be able to publish unauthorized package versions without write access to the repo |
Beta Was this translation helpful? Give feedback.
-
|
Trusted publishing with OIDC is now generally available! Huge thanks to all those who participated in the private preview and provided feedback, that helped us a lot verifying usage and working on small fixes and improvements before the public release! |
Beta Was this translation helpful? Give feedback.
-
|
Nice one! Would love to get OIDC support for Many packages maintain multiple tags for a release. To support this, I now still need to use an API token and they can't be scoped to |
Beta Was this translation helpful? Give feedback.
-
|
Use Casee: I publish a mix of open-source and private npm packages, and managing long-lived tokens in CI/CD can be risky and tedious. OIDC’s short lived, tokenless approach would be a huge security and convenience boost for my workflows. |
Beta Was this translation helpful? Give feedback.
Trusted publishing with OIDC is now generally available!
Huge thanks to all those who participated in the private preview and provided feedback, that helped us a lot verifying usage and working on small fixes and improvements before the public release!