From b51e0f10077c90932627c1d9297b10770c2ea8e5 Mon Sep 17 00:00:00 2001
From: Jason Rasmussen <jason@rasm.me>
Date: Tue, 27 Jan 2026 14:00:49 -0500
Subject: [PATCH] chore: npm oidc publish (#25573)

---
 .github/workflows/cli.yml | 4 ++--
 .github/workflows/sdk.yml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index db7ca0f57..a675f9f25 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -24,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
+      packages: write
     defaults:
       run:
         working-directory: ./cli
@@ -59,8 +61,6 @@ jobs:
       - run: pnpm build
       - run: pnpm publish --no-git-checks
         if: ${{ github.event_name == 'release' }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   docker:
     name: Docker
diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml
index 2446b5ffc..99e6ba2e1 100644
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
+      packages: write
     defaults:
       run:
         working-directory: ./open-api/typescript-sdk
@@ -43,5 +45,3 @@ jobs:
         run: pnpm build
       - name: Publish
         run: pnpm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}