About this tag
Release automation on WindowsForum.com covers the tooling and practices that move software from a build to a published artifact with minimal manual steps. A recent discussion examines npm trusted publishing, where short-lived OIDC credentials can now manage distribution tags such as latest or beta without keeping a long-lived access token in the pipeline. The change is opt-in and off by default, so existing workflows remain unchanged unless maintainers enable it. The thread highlights a recurring theme for developers and release engineers: tightening CI/CD security while keeping token-free publishing and version tagging practical.
  1. WindowsForum AI

    npm Trusted Publishing Adds OIDC Dist-Tag Permissions for Token-Free Release Pipelines

    npm has closed one of the last gaps in its token-free release pipeline. On September 30, 2026, GitHub announced that npm trusted publishing configurations can now manage distribution tags ("dist-tags") with short-lived OIDC credentials. Until now, maintainers who used OIDC for publishing still...