ci: switch npm publishing to trusted publishing (OIDC) + manual backfill

[kevincodex1]

The npm-publish job silently skipped every release since 0.4.x because NPM_TOKEN was never configured — the guard made the job green while @gitlawb/gl sat at 0.3.7 on the registry. Replace token auth entirely:

• npm Trusted Publishing: the job's GitHub OIDC identity (id-token: write) is exchanged with the registry; no long-lived secret to configure, leak, or rotate. Provenance is attested automatically. All five @Gitlawb packages exist on the registry now, so OIDC no longer has the first-publish bootstrap problem that forced token auth in Release automation #127.
• Fail loud: the secret guard is gone. If a package's trusted publisher isn't configured on npmjs.com, the publish errors visibly instead of green-skipping.
• setup-node 24 + npm >=11.5.1 (OIDC exchange support; older npm falls back to absent token auth with a confusing error).
• workflow_dispatch backfill: publish an already-cut GitHub release (e.g. v0.6.0) to npm by tag — binaries come from the existing release assets, so only the npm-publish job runs.

Summary by CodeRabbit

• New Features

  • Added a manual backfill path to publish an existing GitHub release to npm via a required release tag input.
  • Enhanced npm publishing to support both standard release flows and manual backfills.
  • Enabled tokenless npm publishing with provenance metadata and automatic version/tag resolution.

• Bug Fixes

  • Prevented release automation from creating release PRs during manual backfills.
  • Preserved safeguards to avoid duplicate publishing of already-present versions.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f2d846eb-327c-4e87-8671-e30b8218e0f6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The release workflow now supports manual npm backfills from existing release tags, skips release-please during dispatches, and publishes packages using npm trusted publishing with GitHub OIDC provenance.

Changes

NPM publishing workflow

Layer / File(s)	Summary
Backfill tag resolution and release preparation .github/workflows/release.yml	Adds manual tag dispatches, skips release-please for backfills, validates and checks out the resolved tag, stages binaries, and derives package versions from it.
OIDC-based npm publishing .github/workflows/release.yml	Uses GitHub OIDC and npm provenance publishing instead of NPM_TOKEN authentication while preserving package ordering and idempotency checks.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant ReleasePlease
  participant GitTag
  participant NpmRegistry
  GitHubActions->>ReleasePlease: Read release tag for normal publishing
  GitHubActions->>GitHubActions: Select and validate resolved tag
  GitHubActions->>GitTag: Checkout release tag and stage binaries
  GitHubActions->>NpmRegistry: Publish packages with OIDC provenance
  NpmRegistry-->>GitHubActions: Return publish result

Loading

Suggested reviewers: beardthelion

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	It describes the change, but it does not follow the required template and omits sections like kind of change and verification.	Rewrite the description using the repo template, including Summary, Motivation & context, Kind of change, What changed, and How a reviewer can verify.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: npm Trusted Publishing plus a manual backfill path.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/npm-trusted-publishing

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

.github/workflows/release.yml (2)

268-276: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider guarding the dispatch branch by repository, like release-please does.

release-please restricts execution to github.repository == 'Gitlawb/node', but the second branch of this if (github.event_name == 'workflow_dispatch' && inputs.npm_backfill_tag != '') has no such check. On a fork, a manually triggered workflow_dispatch with a tag set would still satisfy this condition and attempt to run gh release download/npm publish using the fork's own GITHUB_TOKEN/OIDC identity. The actual npm publish would likely fail registry-side (trusted publisher is bound to this repo+workflow), but the job would still spend fork secrets/CI time and produce a confusing failure instead of a clean skip.

Proposed fix

     if: >-
       ${{ !cancelled() && (
         (needs.release-please.outputs.release_created == 'true' && needs.release-binaries.result == 'success') ||
-        (github.event_name == 'workflow_dispatch' && inputs.npm_backfill_tag != '')
+        (github.repository == 'Gitlawb/node' && github.event_name == 'workflow_dispatch' && inputs.npm_backfill_tag != '')
       ) }}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 268 - 276, Update the workflow
job condition so the manual npm backfill branch also requires github.repository
== 'Gitlawb/node', matching the existing release-please branch. Preserve the
current release-created and successful-binaries condition while preventing
workflow_dispatch runs with npm_backfill_tag from executing on forks.

---

299-310: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Node/npm bootstrap matches trusted-publishing requirements; zizmor hint is a benign false positive here.

npm trusted publishing requires npm CLI ≥11.5.1 (and Node ≥22.14.0); Node 24 + npm@^11.5.1 satisfies both. actions/setup-node@v5.0.0 does support node-version: "24". The zizmor adhoc-packages warning on line 309 is a generic heuristic for any package install outside a lockfile — here it's bootstrapping the CLI tool itself (not an app dependency), so it's a reasonable false positive; if you want to silence it, exact-pinning (npm@11.5.1) instead of the caret range would be marginally more reproducible, though the caret already enforces the OIDC-capable floor.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 299 - 310, Update the npm
bootstrap command in “Ensure npm supports trusted publishing” to install the
exact version 11.5.1 instead of using the caret range, preserving the existing
verification and Node 24 setup.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 7-16: Update the release-please job-level if condition to require
github.event_name != 'workflow_dispatch' in addition to the existing repository
check. This must skip release-please during manual npm backfill runs while
preserving its behavior for other workflow events.

---

Nitpick comments:
In @.github/workflows/release.yml:
- Around line 268-276: Update the workflow job condition so the manual npm
backfill branch also requires github.repository == 'Gitlawb/node', matching the
existing release-please branch. Preserve the current release-created and
successful-binaries condition while preventing workflow_dispatch runs with
npm_backfill_tag from executing on forks.
- Around line 299-310: Update the npm bootstrap command in “Ensure npm supports
trusted publishing” to install the exact version 11.5.1 instead of using the
caret range, preserving the existing verification and Node 24 setup.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b0951583-4e59-46ad-a86b-70b5e3592f2a

📥 Commits

Reviewing files that changed from the base of the PR and between 2f622ae and 62d73c4.

📒 Files selected for processing (1)

• .github/workflows/release.yml

[kevincodex1]

@coderabbitai please review again approve if its all good!

[coderabbitai]

@kevincodex1 I’ll review the latest changes and approve if everything checks out.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[kevincodex1]

@coderabbitai please check again theres a latest commit make sure we are good

[coderabbitai]

@kevincodex1 I’ll review the latest commit and confirm whether everything is good to go.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.