Example package published using Github OIDC

This is an example package published using Github OIDC.

How does this work?

Other security features

This package uses package.json#packageManager to control the version of pnpm that is used.

It's set to one that has support for minimum-release-age, which I set here to a high value as a demo, given that at the time of writing this the last version of chalk was published 14 days ago.

Changes for monorepos

I used .npmrc here to set the minimum release age, but in a monorepo you'll have a pnpm-workspace.yaml, so you can use minimumReleaseAge: ... in that file.

Read more

• Github OIDC docs
• npm's OIDC publishing docs
• minimumReleaseAge docs

Notes

Given that pnpm forwards the publishing responsibility to npm, you need to make sure that you have npm 11.5.1 or later installed.