Fix npm OIDC publish by removing setup-node registry config

[sestinj]

Summary

• Remove registry-url and always-auth from setup-node in both release workflows — these cause setup-node to set NODE_AUTH_TOKEN to the GitHub token, which npm uses instead of its native OIDC flow, resulting in Access token expired / 404 errors on publish
• Switch beta workflow to OIDC trusted publishing (add id-token: write, --provenance, npm@latest, remove NPM_TOKEN usage)

Test plan

• Re-run the stable release workflow and confirm npm publish --provenance succeeds via OIDC
• Add beta-release.yml as a trusted publisher on npmjs.com for @continuedev/cli
• Verify next beta release publishes successfully with OIDC
• Remove NPM_TOKEN secret from repo after confirming both workflows work

🤖 Generated with Claude Code

---

Continue Tasks: ✅ 7 no changes — View all

---

Summary by cubic

Switch beta and stable release workflows to npm OIDC trusted publishing to fix auth failures during npm publish. Remove setup-node registry settings that injected a GitHub token, add id-token permissions, upgrade to npm@latest, and publish with provenance.

• Bug Fixes

  • Removed setup-node registry-url and always-auth so npm uses OIDC instead of NODE_AUTH_TOKEN.
  • Dropped NPM_TOKEN usage; added permissions: id-token: write.
  • Installed npm@latest and used npm publish --provenance for beta.

• Migration

  • Add beta-release.yml as a trusted publisher for @continuedev/cli on npm.
  • Re-run stable release and confirm OIDC publish works.
  • Remove the NPM_TOKEN secret after both workflows succeed.

^{Written for commit 36d82f7. Summary will update on new commits.}

[continue]

Docs Review

No documentation updates are needed for this PR.

Reason: This PR contains internal CI/CD infrastructure changes to fix npm OIDC trusted publishing in the release workflows. These are purely DevOps changes that:

• Fix authentication flow for npm package publishing
• Remove conflicting setup-node registry configuration
• Add proper OIDC permissions and provenance flags

These changes don't affect any user-facing functionality, CLI usage, installation instructions, or developer workflows. The changes are transparent to end users—the CLI will continue to work exactly as documented.

[cubic-dev-ai]

No issues found across 2 files