[rafalzawadzki]

Summary

• Remove NODE_AUTH_TOKEN from publish workflow — Trusted Publishers authenticates via OIDC, no npm token needed
• The previous run failed with E403 because the npm token was overriding OIDC authentication

Test plan

• Merge and verify the publish workflow succeeds on GitHub Actions
• Verify v0.5.1 appears on npmjs.com with provenance badge

🤖 Generated with Claude Code

[claude]

Claude finished @rafalzawadzki's task —— View job

---

PR Review: Fix npm publish with Trusted Publishers OIDC

I've completed my review of this pull request. Here's my comprehensive feedback:

Todo List

• Read repository setup instructions (CLAUDE.md) - No CLAUDE.md file found
• Analyze the workflow file changes
• Review security implications of removing NODE_AUTH_TOKEN
• Check compliance with npm Trusted Publishers requirements
• Provide comprehensive feedback on the changes

🟢 Overall Assessment: APPROVED

This is an excellent security improvement that follows npm's recommended best practices.

✅ Code Quality & Best Practices

Excellent Change: The removal of NODE_AUTH_TOKEN from .github/workflows/publish.yml:30 is the correct approach when using npm Trusted Publishers. The workflow maintains all necessary permissions and steps.

Workflow Analysis:

• ✅ id-token: write permission is correctly configured (line 12)
• ✅ --provenance flag is used (line 30) which works seamlessly with OIDC
• ✅ Proper build pipeline: install → build → lint → publish
• ✅ Uses pnpm consistently throughout

🔒 Security Assessment

Security Improvement: This change significantly enhances security by:

• ✅ Eliminating long-lived tokens that could be compromised
• ✅ Using OpenID Connect (OIDC) for authentication, which provides short-lived tokens
• ✅ Enabling npm provenance, improving supply chain security
• ✅ Following the principle of least privilege

No Security Concerns: The removal of the token is safe because npm Trusted Publishers automatically handles authentication when:

1. The repository is configured as a trusted publisher on npmjs.com
2. The workflow has id-token: write permission ✅
3. The --provenance flag is used ✅

⚡ Performance Considerations

Neutral Impact: No performance implications. OIDC authentication is typically faster than token-based auth since it eliminates token validation steps.

🧪 Test Coverage

Missing Test Verification: The test plan mentions verifying the publish workflow, but there's no automated way to test this without actually triggering a real publish. This is expected and appropriate for publish workflows.

Recommendation: Consider adding a dry-run test job that uses pnpm publish --dry-run to validate the package can be published without actually publishing.

🔧 Suggestions for Improvement

1. Add dry-run validation (Optional):

   - name: Validate package
     run: pnpm publish --dry-run --provenance --no-git-checks

2. Environment clarity (Optional): Consider adding a comment in the workflow explaining that NODE_AUTH_TOKEN is intentionally omitted when using Trusted Publishers.

📋 Prerequisites Check

Before merging, ensure:

• The npm package n8n-nodes-supadata is configured with this repository as a Trusted Publisher on npmjs.com
• The repository has been added to the trusted publishers list with the correct workflow path

🎯 Conclusion

This PR correctly implements npm Trusted Publishers OIDC authentication. The change is minimal, focused, and follows security best practices. The previous E403 error was indeed caused by the token conflicting with OIDC authentication.

Recommendation: APPROVE and merge. This will resolve the publish failure and improve the package's security posture.

---