[hexqi]

将 @opentiny/fluent-editor 的自动和手动 npm 发布认证切换为 OIDC。保留 auto-publish.yml、dispatch-publish.yml 原有入口、输入默认值、构建环境、版本策略、产物、dist-tag、发布命令和 Release 行为。

仅在实际上传前使用 >=24.19.0 <25 的 Node 24 及其自带 npm，给发布 job 添加 id-token: write 和 contents: read，移除 NPM_TOKEN / NODE_AUTH_TOKEN 注入及手写 npmrc。GitHub Release 使用的独立凭证保留。

验证：全部 workflow YAML 可解析；针对基线的结构比较证明认证之外行为相同；git diff --check 通过。Actionlint 1.7.12 全量检查 before/after 诊断集合相同，已有旧 Action runtime 告警未扩展到本次修复。构建环境及命令未变，未重跑产品构建。

实际发布验证（2026-11-01）：在独立测试分支 test/npm-oidc-validation-20261101 上，手动和 tag 自动发布均通过 GitHub Actions 使用 OIDC 发布 alpha 版本，并由 npm 记录 GitHub Actions Trusted Publisher 和 provenance。旧 npm token secret 清理未验证。

配置验证：Node 范围的 SemVer 边界检查通过；删除冗余 npm 步骤后，YAML 语义对照确认其余配置保持不变，目标 workflow 的 actionlint 前后诊断相同、无新增发现；git diff --check 通过。Node 24.19.0 自带 npm 11.17.0，已满足 OIDC 客户端要求；本次发布 runner 实际使用 Node 24.22.1 / npm 11.19.1。

发布入口	测试版本	Actions	npm / provenance	GitHub Release
手动 dispatch-publish.yml	4.1.3-alpha.1	Dispatch Publish #41285883639	发布成功；provenance 可查	不适用
tag auto-publish.yml	4.1.3-alpha.2 / v4.1.3-alpha.2	Auto Publish #41286102211	发布成功；provenance 可查	alpha 条件下按预期跳过

最终 npm dist-tags：alpha=4.1.3-alpha.2、beta=4.0.0-beta.2、legacy=3.25.10、latest=3.25.12。本次只发布 alpha，latest 未变化。首次 registry 查询遇到短暂同步延迟，稍后版本、dist-tags 和 attestation 均可查，没有重复发布。npm trust list 本机查询因 EOTP 需要一次性密码，未单独枚举服务端 trust；两个版本的 registry metadata 均显示 trustedPublisher.id=github，并提供 SLSA provenance。

Summary by CodeRabbit

• Chores
  • Updated the package publishing process to use trusted publishing and a newer Node.js version.
  • Publishing no longer relies on an npm authentication token stored in the workflow, while selected distribution tags continue to be applied.
  • Pinned the automated browser-testing environment to a supported Ubuntu version for more consistent test runs.
  • These workflow changes do not alter the product experience.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Both publishing workflows now set permissions and a Node.js version for publishing. They remove npm token configuration and keep publishing with the selected distribution tag. The Playwright workflow now uses the Ubuntu 24.04 runner.

Changes

Trusted npm publishing

Layer / File(s)	Summary
Configure publishing permissions and Node.js .github/workflows/auto-publish.yml, .github/workflows/dispatch-publish.yml	Both publish jobs add contents: read and id-token: write permissions and set up Node.js >=24.19.0 <25.
Remove token-based npm authentication .github/workflows/auto-publish.yml, .github/workflows/dispatch-publish.yml	Both publish steps stop writing an npm auth token to ~/.npmrc and stop passing NPM_TOKEN. Each retains npm publish with its selected tag.

Playwright runner

Layer / File(s)	Summary
Pin the Playwright runner .github/workflows/playwright.yml	The workflow replaces ubuntu-latest with ubuntu-24.04 and adds a comment stating that Playwright 1.56.1 does not support Ubuntu 26.04.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: kagol

Merge Risk: Minimal · up to 423b3

This change moves npm publishing from a token to OIDC trusted publishing and pins the E2E runner to Ubuntu 24.04. The author's alpha publishes on a test branch support the new flow, and no actionable merge-blocking issue was found.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "ci: migrate npm publishing to OIDC" names the primary change. The changeset moves the auto-publish and dispatch-publish workflows from npm token auth to OIDC by granting id-token: write and…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "ci: migrate npm publishing to OIDC" names the primary change. The changeset moves the auto-publish and dispatch-publish workflows from npm token auth to OIDC by granting id-token: write and contents: read, setting up Node >=24.19.0, and removing NODE_AUTH_TOKEN and the ~/.npmrc token write. The Playwright runner pin is a minor side change that the title does not need to cover.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the publish gate,
Node is set, the tags stay straight.
No npm token joins the run,
Ubuntu’s runner holds at twenty-four.
I twitch my nose and hop away,
The workflows greet a steady day.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cdb26b5c-542c-46e8-93bb-1e1deabbb63e

Commits

Reviewing files that changed from the base of the PR and between bfa62f3 and 423b3ec.

Files selected for processing: 1

• .github/workflows/playwright.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.