Use GitHub release env for npm publish - #7544
Merged
Merged
Conversation
As this is used for npm OIDC. Also stops passing the token given OIDC doesn't need it
There was a problem hiding this comment.
Pull Request Overview
This PR migrates npm publishing from token-based authentication to OIDC (OpenID Connect) flow for enhanced security by configuring the GitHub Actions workflow to use the release environment and removing the manual NPM_TOKEN configuration.
- Removes manual NPM token configuration from the publish script
- Adds
releaseenvironment to the npm publishing job to enable OIDC authentication - Eliminates the NPM_TOKEN secret dependency from the workflow
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| scripts/publish-npm.sh | Removes manual NPM token authentication setup |
| .github/workflows/build.yml | Configures release environment for OIDC and removes NPM_TOKEN secret |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
tjenkinson
marked this pull request as ready for review
September 18, 2025 15:26
tjenkinson
commented
Sep 18, 2025
| release_npm: | ||
| # npm oidc is configured for this environment | ||
| # https://docs.npmjs.com/trusted-publishers#for-github-actions | ||
| environment: release |
Member
Author
There was a problem hiding this comment.
This environment is configured to only be usable on master or v* tags, which are all protected
Collaborator
There was a problem hiding this comment.
GTK! v1.6 patch tags are going in patch/v1.6.x now. After tagging that branch is merged into master for canary versioning (changes should already be synced via cherry-pick or more advanced).
Member
Author
There was a problem hiding this comment.
cool. As long as all the tags start with v it should all be fine 🤞
although I think you'll need to merge this PR into patch/v1.6.x too so that when it tries to publish the tag from there it still works
robwalch
approved these changes
Sep 18, 2025
github-project-automation
Bot
moved this to Top priorities
in HLS.js Release Planning and Backlog
robwalch
pushed a commit
that referenced
this pull request
Sep 18, 2025
* Use GitHub `release` env for npm publish As this is used for npm OIDC. Also stops passing the token given OIDC doesn't need it * Do not write token to config
robwalch
added a commit
that referenced
this pull request
Sep 22, 2025
* patch/v1.6.x: Get KEYID from init segment 'tenc' when not found elsewhere Fixes #7541 Roll initPTS forward when needed by earlier segments Fixes #7536 Use Widevine KEYID or parse Playready when level keys are present Update keyUriToKeyIdMap set after KEY_LOADING Fixes #7541 #7542 Update npm to v11 before publish Use GitHub `release` env for npm publish (#7544) Fix "Missing format identifier #EXTM3U" playlist parsing errors Fixes #7531
yajin2021
added a commit
to DiceTechnology/hls.js
that referenced
this pull request
Mar 6, 2026
* Parse keyid from multi-key widevine PSSH (video-dev#7415) (cherry picked from commit 3fd4bf3) * Fix PlayReady key endianness (video-dev#7510) (cherry picked from commit f9e23c0) * Error handling for PlayReady key with no status change (video-dev#7527) * Error handling for PlayReady key with no status change video-dev#7508 * Remove hanging promises (except for renewal) * Log append queing * Multivariant Playlist parsing fixes (video-dev#7523) * Move unknown codecs handling to playlist-loader * Add `stats.parsing.end` timing prior to emitting MANIFEST_PARSED on MANIFEST_LOADED (or MANIFEST_PARSING_ERROR) Resolves video-dev#7518 * Add mvp loading and parsing test with `stats.parsing.end` assertion (video-dev#7518) * Fix incorrect LEVEL_LOADED `level` index when lower level removed while loading * Setup as audio-only when main segment has no video Fixes video-dev#7524 * Fix "Missing format identifier #EXTM3U" playlist parsing errors Fixes video-dev#7531 * Use GitHub `release` env for npm publish (video-dev#7544) * Use GitHub `release` env for npm publish As this is used for npm OIDC. Also stops passing the token given OIDC doesn't need it * Do not write token to config * Update npm to v11 before publish Because the OIDC flow needs v11 * Use Widevine KEYID or parse Playready when level keys are present Update keyUriToKeyIdMap set after KEY_LOADING Fixes video-dev#7541 video-dev#7542 * Roll initPTS forward when needed by earlier segments Fixes video-dev#7536 * Get KEYID from init segment 'tenc' when not found elsewhere Fixes video-dev#7541 * fix(interstitials): guard media.play() before chaining .catch() on legacy engines (cherry picked from commit 3df4728) * Resolve setMediaKeys only once media is attached Fixes video-dev#7608 (cherry picked from commit 06339c6) * Fix switching back to main audio after end-of-stream buffered Fixes video-dev#7643 (cherry picked from commit 162d581) * Fix issue where some devices not works with playready (video-dev#7631) (cherry picked from commit 6238bc8) * Resolve end-of-stream with empty or gap segments at end of playlist Fixes video-dev#7572 (and maybe video-dev#7564) (cherry picked from commit 986763d) * Fix audio TS segment duration calculation #video-dev#7646 (comment) * Fixed issue with progressive loading of subtitles by disabling progressive loading for webVTT (video-dev#7649) Authored-by: Kyle Seager <kyle.seager@mydirectv.com> (cherry picked from commit 21eaed6) * Do not reset interstitial when seeking between assets Fixes video-dev#7640 * Fix fallback to primary on live start Fixes video-dev#7641 * Fix FairPlay key ID patching Fixes "keyId is null" error mentioned in video-dev#7542 (comment) video-dev#7654 * chore: version patch * fix:add missing changes --------- Co-authored-by: yajin2021 <83813017+yajin2021@users.noreply.github.com> Co-authored-by: Shubham Sharma <124438439+ShubhamSharma2311@users.noreply.github.com> Co-authored-by: Rob Walch <robwalch@users.noreply.github.com> Co-authored-by: Rob Walch <rwalch@apple.com> Co-authored-by: Tom Jenkinson <tjenkinson@users.noreply.github.com> Co-authored-by: Tom Jenkinson <tom@tjenkinson.me> Co-authored-by: Filip Majerík <filip.majerik@4net.tv> Co-authored-by: KunXi-Fox <117630690+KunXi-Fox@users.noreply.github.com> Co-authored-by: Kyle Seager <krseager1@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR will...
Use the new release environment and stop providing the npm token. Publishes will then use the OIDC flow which is configured on npm and more secure as we can restrict all publishes to come from this workflow.
Why is this Pull Request needed?
Help mitigate against attacks like https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html