jethac opened a new issue, #42992: URL: https://github.com/apache/superset/issues/42992
### Problem `release.yml` and `embedded-sdk-release.yml` authenticate to npm with an `NPM_TOKEN` secret. A long-lived publish token is a standing credential: it does not expire, it is exfiltratable by anything that can read the workflow environment, and its compromise means arbitrary publishes under the org's package names. npm supports trusted publishing via OIDC, which exchanges a short-lived, workflow-scoped identity for publish rights and removes the stored secret entirely. Several recent npm compromises turned on exactly this kind of stolen token. ### Proposed change Migrate both workflows to OIDC trusted publishing and delete the `NPM_TOKEN` secret once the first release under it succeeds. Worth doing one workflow first and confirming a real publish before moving the second. Verified against `master` at `3539c41dab`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
