From 8d9130ec636c20f2c306539de118f647a52a8cbe Mon Sep 17 00:00:00 2001
From: "Pedro S. Lopez" <pedroslopez@me.com>
Date: Mon, 5 Jan 2026 01:34:03 -0400
Subject: [PATCH] fix release script, use OIDC (#5713)

---
 .github/workflows/release.yml |  7 ++++---
 tools/publish                 | 38 +++++++++++++++++------------------
 2 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2177fd0..abff02f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,8 +12,11 @@ jobs:
   release:
     runs-on: ubuntu-latest
     if: ${{ github.repository == 'pedroslopez/whatsapp-web.js' }}
+    permissions:
+      contents: write
+      id-token: write
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           token: ${{ secrets.RELEASE_GITHUB_TOKEN }}
       - run: git config --global user.email "hello@wwebjs.dev"
@@ -21,8 +24,6 @@ jobs:
       - name: Bump version and publish to NPM
         id: publish
         run: ./tools/publish ${{ github.event.inputs.release_type }}
-        env:
-          NPM_TOKEN: ${{ secrets.RELEASE_NPM_TOKEN }}
       - name: Create GitHub Release
         id: create_release
         uses: ncipollo/release-action@v1
diff --git a/tools/publish b/tools/publish
index 516707c..fab9883 100755
--- a/tools/publish
+++ b/tools/publish
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -e
 
 cd "$(dirname "$0")"
 cd '..'
@@ -40,17 +41,18 @@ else
   exit 1
 fi
 
-if [ -f ~/.npmrc ]; then
-  echo "Found existing .npmrc"
+# Note: When running in GitHub Actions with trusted publishing (OIDC),
+# npm whoami won't work as OIDC auth only applies during npm publish.
+# For local publishing, ensure you're logged in with 'npm login'.
+if [[ -z "$CI" ]] && ! npm whoami &> /dev/null; then
+  echo "Not authenticated with npm. Run 'npm login' to authenticate."
+  exit 1
+fi
+if [[ -z "$CI" ]]; then
+  echo "Publishing as NPM user: $(npm whoami)"
 else
-  if [[ -z "$NPM_TOKEN" ]];then
-    echo "No NPM_TOKEN or ~/.npmrc, exiting.."
-    exit 1;
-  else
-    echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-  fi
+  echo "Publishing via GitHub Actions OIDC trusted publishing"
 fi
-echo "Publishing as NPM user: `npm whoami`"
 
 if [[ $BRANCH != 'main' ]]; then
   echo "Not on 'main' branch.  Exiting"
@@ -66,9 +68,12 @@ echo ""
 echo "-----> BUMP VERSION"
 echo ""
 
-npm version $VERSION_ARGS || exit 1
+npm version $VERSION_ARGS
 
-git push && git push --tags || exit 1
+git push && git push --tags
+
+NEW_VERSION=$(cat package.json | jq -r .version)
+echo "New Version: $NEW_VERSION"
 
 npm install
 
@@ -78,10 +83,7 @@ git add .
 
 git commit -am "chore(${NEW_VERSION}): generate docs"
 
-git push 
-
-NEW_VERSION=`cat package.json | jq -r .version`
-echo "New Version: $NEW_VERSION"
+git push
 
 echo ""
 echo "-----> PUSH TO NPM"
@@ -95,7 +97,5 @@ echo "-----> Done!"
 echo "Version $NEW_VERSION published to $DIST_TAG tag"
 echo ""
 
-echo "::set-output name=NEW_VERSION::$NEW_VERSION"
-echo "::set-output name=PRERELEASE::$PRERELEASE"
-
-exit 0
+echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
+echo "PRERELEASE=$PRERELEASE" >> $GITHUB_OUTPUT