[TASK] Migrate npm “classic tokens” to granular access tokens across CI/CD

Description

npm is revoking classic tokens in early November per the Phase 1 security changes email. To avoid publish/build disruptions, we need to replace any classic tokens used in automation (CI/CD, release scripts, local dev tooling) with granular access tokens that have scoped permissions and limited lifetimes.

This task covers discovery, migration, and validation across all dotCMS repositories and pipelines that interact with npm (install, publish, auth). It also documents the new process so future rotations don’t break builds.

Acceptance Criteria

• Inventory complete

  • Catalog all repos/workflows where npm auth is configured (GitHub Actions, Jenkins, local release scripts).
  • Confirm which ones use classic tokens today.

• Token strategy implemented

  • Create granular access tokens with minimal scopes (read/publish as needed).
  • Set lifetimes ≤ 1 year.
    • Ideally rotate secrets in CI/CD and release scripts.
    • But if not, set reminders in slack channels
  • use @dotCMS-Machine-User to generate tokens if they need to be tied to a user account
  • update secrets in github action AND password database

• Pipelines green

  • Dry-run and real publish jobs succeed using granular tokens.
  • npm install/auth steps pass across affected workflows.

• Security hygiene

  • Revoke and remove all classic tokens.
  • Add docs for creating/rotating granular tokens, required scopes per workflow, rotation cadence, and break-glass steps.

• Audit trail

  • Link PRs/workflow changes.
  • Confirm readiness date before early November revocation.

Priority

High

Additional Context

• Assumptions / Questions

  • Do we have any non-GitHub CI systems still in use (e.g., Jenkins or self-hosted runners) that publish to npm?
  • Are nightly builds or prerelease tags publishing anywhere that use separate tokens?
  • Preferred token lifetime: stick to 7-day default with scheduled rotation, or use up to 90 days with calendar reminders?

• Risk

  • If any pipeline still references a classic token after revocation, publishes will fail; installs that require private package access may also break.

• Reference: npm security email indicates

  • Oct 13: granular tokens with 90-day max lifetime (7-day default); new TOTP 2FA configurations disabled (existing TOTP still works).
  • Early November: classic tokens permanently revoked.
  • slack message

original email text

Important security changes are coming to npm that may affect your packages and workflows. This is the first phase of our comprehensive security improvements.

Phase 1 changes:
• October 13: New granular tokens limited to 90-day maximum lifetime (7-day default)
• October 13: New TOTP 2FA configurations disabled (existing TOTP still works)
• Early November: All classic tokens will be permanently revoked

Action required:
If you use classic tokens in any automation, CI/CD pipelines, or local development, you must migrate to granular access tokens before early November to avoid publishing disruptions.

More changes ahead:
This is the first of several security updates. Additional phases will follow in the coming months, including further 2FA improvements and expanded trusted publisher support. We'll communicate each phase in advance.

Why we're making these changes:
Recent supply chain attacks have shown that compromised long-lived tokens are a critical vulnerability. These phased changes are essential to protect the npm ecosystem and your packages from malicious actors.

Get full details and migration guidance:
https://gh.io/npm-token-changes

Need help?
• Join the discussion: https://github.com/orgs/community/discussions/174507
• Contact support: https://www.npmjs.com/support

We understand these changes require effort from you. Thank you for your partnership in making npm more secure for millions of developers worldwide.

The npm Team