Trusted publishing for npm packages ◆ npm Docs
Managed identities for artifact publication is great. Let’s just make sure it doesn’t come at the cost of traceability.
Trusted publishing allows you to publish npm packages directly from your CI/CD workflows using OpenID Connect (OIDC) authentication, eliminating the need for long-lived npm tokens. This feature implements the trusted publishers industry standard specified by the Open Source Security Foundation (OpenSSF), joining a growing ecosystem including PyPI, RubyGems, and other major package registries in offering this security enhancement.
Like machine identities and SPIFFEE in the cloud. Nice!
- GitHub Actions (GitHub-hosted runners) - GitLab CI/CD Pipelines (GitLab.com shared runners)
The benefits are obvious. But are we losing control? All these “managed identities” usually fail to provide the same level of logging and traceability we expect when we manage our own identities.
