fix(release): unblock npm trusted publishing (Node 24 + provenance flags)

.changeset/fix-oidc-publish.md

@@ -0,0 +1,9 @@
+---
+"@deessejs/errors": patch
+---
+
+Fix npm trusted publishing (OIDC) end-to-end. Three changes:
+
+1. Release workflow bumps Node 22 → 24 (the runner default; matches our other release workflows, and aligns with npm CLI ≥ 11.5.1 + Node ≥ 22.14.0 requirements for trusted publishing).
+2. `Publish packages` step now passes `env: NPM_CONFIG_PROVENANCE: 'true'`, which forces pnpm publish down the OIDC code path instead of falling back to a token.
+3. `packages/errors/package.json` now declares `publishConfig.provenance: true`, so npm always emits a provenance attestation on publish (belt + suspenders alongside the env var).

.github/workflows/release.yml

@@ -46,7 +46,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -88,6 +88,8 @@ jobs:
 
       - name: Publish packages
         if: steps.detect.outputs.has_changesets == 'true' && (github.event_name == 'workflow_dispatch' || inputs.dry_run != true)
+        env:
+          NPM_CONFIG_PROVENANCE: 'true'
         run: |
           if [ -n "${{ inputs.packages }}" ]; then
             pnpm changeset publish --packages=$(echo "${{ inputs.packages }}" | tr ',' ' ')

packages/errors/package.json

@@ -34,6 +34,10 @@
   ],
   "author": "Nesalia Inc. <hello@nesalia.com>",
   "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "devDependencies": {
     "@eslint/js": "^9.0.0",
     "@types/node": "^25.9.1",