This repository was archived by the owner on Oct 28, 2026. It is now read-only.
Repository navigation
Prepare tokenless npm publishing - #314
Merged
Merged
Conversation
Use supported Node and npm with job-scoped OIDC instead of a stored token. Restore publishing prerequisites through the approved package feeds. Preserve the prepared package version and existing publication triggers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Vladimir Morozov (vmoroz)
enabled auto-merge (squash)
October 27, 2026 23:36
Nikolai Aristov (NikoAri)
approved these changes
Oct 27, 2026
Vladimir Morozov (vmoroz)
added a commit
that referenced
this pull request
Oct 28, 2026
# Avoid token-style npm config for OIDC publishing ## Why The tokenless setup from #314 fails before dependency installation. setup-node's `registry-url` input generates an npmrc referencing `NODE_AUTH_TOKEN`, which is intentionally unset for OIDC; Yarn classic rejects that unresolved reference. ## What - **Tokenless installation.** Remove the redundant setup-node registry input so Yarn does not require token authentication configuration. - **Unchanged destinations.** Keep the existing explicit proxy-install and public-publish registry flags, OIDC permissions, and package version. ## Testing Reproduced the exact Yarn error; tokenless regression, frozen install, build, both example suites and workflow schema checks passed. Publication was not retried. ## Changelog Should this change be included in the release notes: no. Avoid token-style npm configuration in the OIDC publishing workflow. ###### Microsoft Reviewers: [Open in CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com/microsoft/react-native-xaml/pull/315) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepare tokenless npm publishing
Why
Prepare the existing Publish workflow to release the final react-native-xaml
notice version using npm trusted publishing instead of a stored npm token.
What
grant OIDC permission only to the publishing job. Remove the token reference
without deleting the stored secret.
and Codegen NuGet dependencies through PackageFeedProxy, with no implicit
Codegen restore afterward.
pinned actions and package version. npm-side trust must be configured before
any future publishing run.
Testing
Workflow schemas, npm-version checks, proxy restores, TypeScript/C# builds
and both example suites passed. Live OIDC and publishing were not exercised.
Changelog
Should this change be included in the release notes: no. Prepare tokenless
authentication and approved dependency restores for the publishing workflow.
Microsoft Reviewers: Open in CodeFlow