[theia-dev] NPM Publish Notifications and switch to NPM trusted workflow

[Nina Doschek <ndoschek@xxxxxxxxxxxxxxxxx>]

Hi everyone,

You probably noticed an unusual number of npm publish emails recently.
This spike is due to our full switch to the trusted publishing workflow.

Unfortunately, npm currently doesn’t offer a way to disable these “package published” notifications.
For reference, here’s a related discussion: https://github.com/npm/feedback/discussions/424

If the emails are too noisy, you can set up an email filter to auto-archive them.
Here’s the filter I use as an example:

On the positive side, our migration to the npm trusted publishing workflow is now complete.
We now have a single publish workflow that supports next, minor, and patch releases.

Manual publishing (with required 2FA) is still possible when needed, and we no longer rely on the classic npm token.

For those interested in the details, here are the relevant PRs:

• https://github.com/eclipse-theia/theia/pull/16630
• https://github.com/eclipse-theia/theia/pull/16650

Thanks and have a great day!

Nina

Nina Doschek, MSc

Senior Software Architect

EclipseSource Austria

Email: ndoschek@xxxxxxxxxxxxxxxxx

Web: https://eclipsesource.com/austria

EclipseSource Services GmbH

Schwindgasse 20 / 2-3

1040 Wien

General Manager: Dr. Philip Langer

Registered Office: Schwindgasse 20/2-3, 1040 Wien; Handelsgericht Wien, FN 421413a