GeezerVison

Summary

• Switch npm-publish to npm stage publish so releases go through npm's staging queue and require a 2FA-gated human approval before becoming installable.
• Bump actions/setup-node to v6.4.0 with package-manager-cache: false (kills the always-auth deprecation warning from v4).
• Drop --provenance — OIDC trusted publishing emits provenance automatically.
• Add a step that writes per-package review links and an org-dashboard URL to the workflow run's step summary, plus a ::notice:: pointing maintainers straight at the staged-packages dashboard.

Why

The previous release failed with 403 OIDC permission denied for this action because npm's trusted-publisher rules (effective 2026-05-20) require the allowed-action checkbox to be explicit, and direct npm publish from CI is no longer the recommended path for trusted-publisher-driven workflows. Staged publishing pairs with trusted publishing to give "proof of presence" on every release — a stolen OIDC token cannot ship a malicious version without a maintainer's 2FA approval.

Required manual setup (one-time, per package)

For each of the 15 packages, visit https://www.npmjs.com/package/@socketsecurity/<pkg>/access and configure a Trusted Publisher:

• Publisher: GitHub Actions
• Organization: SocketDev
• Repository: socket-patch
• Workflow filename: release.yml
• Environment: (blank)
• Allowed actions: ✅ npm publish and ✅ npm stage publish

Packages: socket-patch, socket-patch-android-arm64, socket-patch-darwin-{arm64,x64}, socket-patch-linux-{arm,arm64,ia32,x64}-{gnu,musl}, socket-patch-win32-{arm64,ia32,x64}.

Without this, the workflow will still 403.

Maintainer approval flow (per release)

After the workflow finishes, the run page's step summary lists every staged version with its review URL. Approve platform packages first (so optionalDependencies resolution sees binaries when the main package goes live), then the main @socketsecurity/socket-patch package. Two paths:

• Web: click each link → Approve (2FA prompt inline).
• CLI: npm stage list then npm stage approve <stage-id> per package (requires [email protected]+ locally + 2FA device).

npm stage approve cannot use OIDC tokens by design, so this step is necessarily a human + 2FA action.

Cleanup follow-up

The previous failing run showed NODE_AUTH_TOKEN: XXXXX-... getting auto-injected from an org/repo secret of that name. With OIDC it's unused (npm 11.15.0+ prefers OIDC env vars over _authToken), but the secret should eventually be deleted to remove the fallback path.

Test plan

• Configure trusted publishers on all 15 packages on npmjs.com (manual prerequisite).
• Bump Cargo.toml to a new patch version + add CHANGELOG.md entry.
• Trigger Release workflow with dry-run: false.
• Confirm npm-publish job succeeds with no always-auth warning and no 403.
• Confirm the run's step summary lists 15 packages with review URLs.
• Approve platform packages, then the main package; verify npm install @socketsecurity/socket-patch@<new-version> resolves with the right binary and shows "Built and signed on GitHub Actions" provenance in the UI.

🤖 Generated with Claude Code