From b296d1f6cd9630d374acf8e8042894da3e7be278 Mon Sep 17 00:00:00 2001 From: David Shoen Date: Wed, 24 Jun 2026 12:37:11 +0300 Subject: [PATCH 1/2] ci: publish via npm Trusted Publishing (OIDC) instead of NPM_TOKEN The publish job authenticated to npm with a long-lived NPM_TOKEN secret, which expired and caused the 2.7.6 release to fail (registry returned "Not found" / 404 on publish). Mirror permit-fe-sdk's move to OIDC-based npm Trusted Publishing so releases no longer depend on a stored token. - add id-token: write (and contents: read) permissions for OIDC - run the job in the `production` environment (matches the npm Trusted Publisher config) - upgrade npm to latest at runtime (Trusted Publishing needs npm >= 11.5.1) - publish with `npm publish` instead of `yarn publish` (yarn classic does not support OIDC); drop the NODE_AUTH_TOKEN env - strip a leading `v` from the release tag before writing the version so tags like `v2.7.6` produce valid semver - provenance attestations are generated automatically under Trusted Publishing Requires a Trusted Publisher configured on npmjs.com for permitio/permit-node (workflow: node_sdk_publish.yaml, environment: production). The NPM_TOKEN repo secret can be removed once this is merged and a release succeeds. Refs PER-15197. Secret-leak hardening of this workflow tracked in PER-15241. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/node_sdk_publish.yaml | 32 ++++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/.github/workflows/node_sdk_publish.yaml b/.github/workflows/node_sdk_publish.yaml index 7f03e5f..04f7850 100644 --- a/.github/workflows/node_sdk_publish.yaml +++ b/.github/workflows/node_sdk_publish.yaml @@ -10,17 +10,23 @@ env: jobs: publish_node_sdk: runs-on: ubuntu-latest + environment: production + permissions: + contents: read + id-token: write # Required for npm Trusted Publishing (OIDC) steps: - name: Checkout code uses: actions/checkout@v4 - + - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: '20' registry-url: 'https://registry.npmjs.org' - token: ${{ secrets.NPM_TOKEN }} - + + - name: Upgrade npm for Trusted Publishing + run: npm install -g npm@latest && npm --version + - name: Set git user run: | git config --global user.email "eli@permit.io" @@ -83,18 +89,26 @@ jobs: - name: Bump version at package.json run: | - sed -i "s/\"version\": \".*\"/\"version\": \"${{ github.event.release.tag_name }}\"/" package.json + # Use the release tag as the version, stripping any leading 'v' + # (e.g. 'v2.7.6' -> '2.7.6') so it is valid semver for npm. + VERSION=${{ github.event.release.tag_name }} + VERSION=${VERSION#v} + sed -i "s/\"version\": \".*\"/\"version\": \"$VERSION\"/" package.json cat package.json - + - name: Publish package to NPM run: | if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then echo "Publishing as a release candidate (rc)..." - yarn publish --access public --tag rc + npm publish --access public --tag rc else echo "Publishing as the latest release..." - yarn publish --access public + npm publish --access public fi - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + # No NPM_TOKEN needed — authenticated via npm Trusted Publishing (OIDC), + # which requires the job's `id-token: write` permission above plus a + # Trusted Publisher configured on npmjs.com: + # permitio/permit-node -> Settings -> Trusted Publishers + # (workflow: node_sdk_publish.yaml, environment: production) + # Provenance attestations are generated automatically. From fdbc28f4189176c36df62d27c91703b6bce4b653 Mon Sep 17 00:00:00 2001 From: David Shoen Date: Wed, 24 Jun 2026 13:51:10 +0300 Subject: [PATCH 2/2] ci: mask fetched Permit API key so it is not logged in cleartext The Fetch API_KEY step wrote the env api key to $GITHUB_ENV and echoed it directly, so it appeared in cleartext in the run logs and in the env-group dump of every later step. Register the value with ::add-mask:: before exporting it, and drop the explicit echo, so it is redacted everywhere. PROJECT_API_KEY should still be rotated since it was exposed in prior runs. Fixes PER-15241. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/node_sdk_publish.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/node_sdk_publish.yaml b/.github/workflows/node_sdk_publish.yaml index 04f7850..ab6b1a2 100644 --- a/.github/workflows/node_sdk_publish.yaml +++ b/.github/workflows/node_sdk_publish.yaml @@ -61,10 +61,12 @@ jobs: https://api.permit.io/v2/api-key/${{ env.PROJECT_ID }}/${{ env.ENV_ID }} \ -H 'Authorization: Bearer ${{ secrets.PROJECT_API_KEY }}') - # Extract the secret from the response which is the API_KEY of the new env - echo "ENV_API_KEY=$(echo "$response" | jq -r '.secret')" >> $GITHUB_ENV - - echo "New env api key: $ENV_API_KEY" + # Extract the api key secret and register it for masking BEFORE writing + # it to the environment, so it is redacted everywhere in the logs + # (including the env-group dumps of every later step). Do not echo it. + ENV_API_KEY=$(echo "$response" | jq -r '.secret') + echo "::add-mask::$ENV_API_KEY" + echo "ENV_API_KEY=$ENV_API_KEY" >> "$GITHUB_ENV" - name: local PDP runnning env: