Adopt Trusted Publishing and Supply Chain Security Best Practices

As I’m sure you may be aware GitHub recently announced changes to NPM publishing (https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/) and is encouraging projects to switch to trusted publishing as soon as they are able.

OpenCode currently uses a long-lived NPM token for publishing and does not leverage basic features such as branch protection for the default branch.

Can OpenCode adopt these measures to protect downstream users?

makes sense

To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.

Navigation Menu