AUTOMATED NPM SECRET ROTATION IN GITHUB ACTIONS

Summary from the TLDR Dev newsletter

NPM recently announced that all long-lived tokens are being revoked and new tokens will only be valid for a maximum of 90 days, creating challenges for automated publishing workflows. While the proper solution is to upgrade to trusted publishing (OIDC), a tool called "github-update-secret" automatically rotates secrets across all repositories to buy time until each project can be properly migrated. This tool iterates through all repositories with admin access and updates any matching secret names with new values.