fix: npm release failing

[varonix0]

Description 📣

Added NPM trusted publisher which uses OIDC auth to avoid having a static access token with a TTL.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[greptile-apps]

Greptile Summary

This PR adds the id-token: write permission to enable NPM OIDC authentication, but doesn't actually implement it. The workflow continues using the static NPM_TOKEN secret throughout the npm-release job (lines 68-88), meaning the security improvement described in the PR isn't achieved.

• Added id-token: write permission in workflow permissions
• Issue: Static NPM_TOKEN secret is still used for authentication - OIDC not actually implemented
• The .npmrc setup and publish steps need to be updated to use NPM provenance publishing with the --provenance flag instead of token-based auth

Confidence Score: 2/5

• This PR is incomplete and doesn't fix the npm release issue as described
• The PR claims to add NPM trusted publisher with OIDC auth but only adds the permission without implementing the actual OIDC authentication mechanism. The workflow still relies on the static NPM_TOKEN secret, which means the security improvement isn't realized and the npm release issue may not be fixed
• The workflow file needs significant changes to actually implement OIDC authentication - remove token-based auth and add provenance publishing

Important Files Changed

Filename	Overview
.github/workflows/release_build_infisical_cli.yml	Added id-token: write permission but the workflow still uses static NPM_TOKEN secret - OIDC authentication not actually implemented

[greptile-apps]

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}