CICD-SEC-2 — Package published with a long-lived token instead of OIDC

Publishing with a standing registry token where OIDC trusted publishing is available.

Field	Value
Category	CICD-SEC-2
Severity	MEDIUM
Confidence	HIGH
OWASP	CICD-SEC-2: Inadequate Identity and Access Management
Auto-fix	✗

What the check does

Flags a publishing step that authenticates to a package registry with a long-lived token where the registry supports OIDC trusted publishing:

• PyPI via pypa/gh-action-pypi-publish with a password: input
• npm publish with NODE_AUTH_TOKEN
• cargo publish with CARGO_REGISTRY_TOKEN
• gem push with GEM_HOST_API_KEY

Why it matters

A long-lived registry token is a standing secret: if it leaks (a poisoned dependency, a log spill, a compromised runner) an attacker can publish malicious package versions until someone notices and rotates it. OIDC trusted publishing replaces the standing token with a short-lived credential minted per run and scoped to the specific workflow, so there is no durable secret to steal.

- uses: pypa/gh-action-pypi-publish@<sha>
  with:
    password: ${{ secrets.PYPI_TOKEN }}   # ← standing secret

Safe alternative

Configure trusted publishing on the registry and drop the token. For PyPI:

permissions:
  id-token: write            # ← OIDC token for this run
steps:
  - uses: pypa/gh-action-pypi-publish@<sha>   # no password: needed

See PyPI trusted publishers and the equivalent OIDC flows for npm, crates.io, and RubyGems.