Problem
The requestNetwork SDK currently uses long-lived NPM tokens (circleci-requestNetwork) for package publishing. This poses security risks if tokens are compromised or exposed, and doesn't align with NPM's new security recommendations for token management.
Proposed Solution
Migrate from long-lived tokens to OIDC Trusted Publisher authentication:
- Configure trusted publishers on npmjs.com for all @RequestNetwork SDK packages
- Update CircleCI configuration to use OIDC authentication
- Remove long-lived
circleci-requestNetwork token after successful migration
Considerations
- Blocker: CircleCI doesn't currently support OIDC/Trusted Publishers for NPM
- Alternative: Consider migrating CI/CD from CircleCI to GitHub Actions (which supports OIDC)
- Interim: Continue using granular access tokens with 90-day expiration when NPM enforces the restriction
- Impact: Approximately 20+ packages published from this repository would need updated publisher configuration
Related: web-components (RequestNetwork/web-components#345) and request-cli (RequestNetwork/request-cli#13) already migrated to OIDC using GitHub Actions.
Problem
The requestNetwork SDK currently uses long-lived NPM tokens (
circleci-requestNetwork) for package publishing. This poses security risks if tokens are compromised or exposed, and doesn't align with NPM's new security recommendations for token management.Proposed Solution
Migrate from long-lived tokens to OIDC Trusted Publisher authentication:
circleci-requestNetworktoken after successful migrationConsiderations
Related: web-components (RequestNetwork/web-components#345) and request-cli (RequestNetwork/request-cli#13) already migrated to OIDC using GitHub Actions.