You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
SDK - Migrate to OIDC Trusted Publisher for NPM publishing #1648
The requestNetwork SDK currently uses long-lived NPM tokens (circleci-requestNetwork) for package publishing. This poses security risks if tokens are compromised or exposed, and doesn't align with NPM's new security recommendations for token management.
Proposed Solution
Migrate from long-lived tokens to OIDC Trusted Publisher authentication:
Configure trusted publishers on npmjs.com for all @RequestNetwork SDK packages
Update CircleCI configuration to use OIDC authentication
Remove long-lived circleci-requestNetwork token after successful migration
Considerations
Blocker: CircleCI doesn't currently support OIDC/Trusted Publishers for NPM
Alternative: Consider migrating CI/CD from CircleCI to GitHub Actions (which supports OIDC)
Interim: Continue using granular access tokens with 90-day expiration when NPM enforces the restriction
Impact: Approximately 20+ packages published from this repository would need updated publisher configuration
Activity