HOW WE RELEASE FASTIFY PACKAGES WITHOUT NPM TOKENS

Summary from the TLDR InfoSec newsletter

Fastify moved about 100 repositories from manual laptop releases to GitHub Actions using npm Trusted Publishers, which replace long-lived npm tokens with short-lived OIDC tokens bound to a specific repo, workflow, and environment. Releases are triggered manually via workflow_dispatch and wait for approval from the fastify/release team in a release environment restricted to main, then published with provenance through a SHA-pinned reusable workflow. Maintainers can script the same setup with npm trust github (npm 11.15.0+) and the GitHub environments API, then remove non-admin npm publish rights.