Support publishing via OIDC authentication (#772)

Author: WillsB3

source/npm/oidc.js

@@ -0,0 +1,28 @@
+import process from 'node:process';
+
+const oidcProviders = [
+	{
+		id: 'github',
+		name: 'GitHub Actions',
+		// See https://github.com/npm/cli/blob/7da8fdd3625dd5541af57052c90fe1eabb41eb96/lib/utils/oidc.js#L49-L67
+		// See https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#adding-permissions-settings
+		validate: () =>
+			process.env.GITHUB_ACTIONS
+			&& process.env.ACTIONS_ID_TOKEN_REQUEST_URL
+			&& process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,
+	},
+	{
+		id: 'gitlab',
+		name: 'GitLab CI',
+		// See https://github.com/npm/cli/blob/7da8fdd3625dd5541af57052c90fe1eabb41eb96/lib/utils/oidc.js#L37-L47
+		validate: () => process.env.GITLAB_CI && process.env.NPM_ID_TOKEN,
+	},
+];
+
+export const getOidcProvider = () => {
+	for (const provider of oidcProviders) {
+		if (provider.validate()) {
+			return provider.id;
+		}
+	}
+};

source/prerequisite-tasks.js

@@ -5,6 +5,7 @@ import Version from './version.js';
 import * as util from './util.js';
 import * as git from './git-util.js';
 import * as npm from './npm/util.js';
+import {getOidcProvider} from './npm/oidc.js';
 
 const prerequisiteTasks = (input, package_, options, packageManager) => {
 	const isExternalRegistry = npm.isExternalRegistry(package_);
@@ -26,6 +27,11 @@ const prerequisiteTasks = (input, package_, options, packageManager) => {
 		{
 			title: 'Verify user is authenticated',
 			enabled: () => process.env.NODE_ENV !== 'test' && !package_.private,
+			skip() {
+				if (getOidcProvider()) {
+					return 'Environment support for OIDC authentication detected - Skipping whoami check';
+				}
+			},
 			async task() {
 				const externalRegistry = isExternalRegistry ? package_.publishConfig.registry : false;
 				const username = await npm.username({externalRegistry});

test/_helpers/listr.js

@@ -18,3 +18,8 @@ export const assertTaskDisabled = (t, taskTitle) => {
 export const assertTaskDoesntExist = (t, taskTitle) => {
 	t.true(SilentRenderer.tasks.every(task => task.title !== taskTitle), `Task '${taskTitle}' exists!`);
 };
+
+export const assertTaskSkipped = (t, taskTitle) => {
+	const task = SilentRenderer.tasks.find(task => task.title === taskTitle);
+	t.true(task.isSkipped(), `Task '${taskTitle}' was not skipped!`);
+};

test/npm/oidc.js

@@ -0,0 +1,39 @@
+import test from 'ava';
+import esmock from 'esmock';
+
+test('detects GitHub Actions', async t => {
+	const {getOidcProvider} = await esmock('../../source/npm/oidc.js', {
+		'node:process': {
+			env: {
+				GITHUB_ACTIONS: 'true',
+				ACTIONS_ID_TOKEN_REQUEST_URL: 'https://example.com',
+				ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token',
+			},
+		},
+	});
+
+	t.is(getOidcProvider(), 'github');
+});
+
+test('detects GitLab CI', async t => {
+	const {getOidcProvider} = await esmock('../../source/npm/oidc.js', {
+		'node:process': {
+			env: {
+				GITLAB_CI: 'true',
+				NPM_ID_TOKEN: 'token',
+			},
+		},
+	});
+
+	t.is(getOidcProvider(), 'gitlab');
+});
+
+test('detects no OIDC', async t => {
+	const {getOidcProvider} = await esmock('../../source/npm/oidc.js', {
+		'node:process': {
+			env: {},
+		},
+	});
+
+	t.is(getOidcProvider(), undefined);
+});

test/tasks/prerequisite-tasks.js

@@ -4,7 +4,12 @@ import {npmConfig, yarnConfig} from '../../source/package-manager/configs.js';
 import {npPackage} from '../../source/util.js';
 import {SilentRenderer} from '../_helpers/listr-renderer.js';
 import {_createFixture} from '../_helpers/stub-execa.js';
-import {run, assertTaskFailed, assertTaskDisabled} from '../_helpers/listr.js';
+import {
+	run,
+	assertTaskFailed,
+	assertTaskDisabled,
+	assertTaskSkipped,
+} from '../_helpers/listr.js';
 
 /** @type {ReturnType<typeof _createFixture<import('../../source/prerequisite-tasks.js')>>} */
 const createFixture = _createFixture('../../source/prerequisite-tasks.js', import.meta.url);
@@ -237,3 +242,22 @@ test.serial('checks should pass', createFixture, [{
 }], async ({t, testedModule: prerequisiteTasks}) => {
 	await t.notThrowsAsync(run(prerequisiteTasks('2.0.0', {name: 'test', version: '1.0.0'}, {}, npmConfig)));
 });
+
+test.serial('should skip authentication check when OIDC is detected', createFixture, [{
+	command: 'git rev-parse --quiet --verify refs/tags/v2.0.0',
+	stdout: '',
+}], async ({t, testedModule: prerequisiteTasks}) => {
+	process.env.NODE_ENV = 'P';
+	process.env.GITHUB_ACTIONS = 'true';
+	process.env.ACTIONS_ID_TOKEN_REQUEST_URL = 'url';
+	process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN = 'token';
+
+	await t.notThrowsAsync(run(prerequisiteTasks('2.0.0', {name: 'test', version: '1.0.0'}, {}, npmConfig)));
+
+	delete process.env.GITHUB_ACTIONS;
+	delete process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+	delete process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+	process.env.NODE_ENV = 'test';
+
+	assertTaskSkipped(t, 'Verify user is authenticated');
+});