ci: npm publish via OIDC Trusted Publishing (no token)

[saucam]

Now that codeoid@0.1.0 is on npm, switch CI releases to OIDC Trusted Publishing so no NPM_TOKEN is ever needed (and we sidestep the 2FA/EOTP friction entirely).

Diff

• Drop NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} — auth is the GitHub Actions OIDC id-token (the workflow already has id-token: write).
• Add npm install -g npm@latest — Trusted Publishing needs npm >= 11.5.1; node 22 ships 10.x.
• Provenance is still produced, now from the OIDC identity.

⚠️ One-time setup on npm (only you can do this)

On npmjs.com → codeoid package → Settings → Trusted Publisher → Add:

• Publisher: GitHub Actions
• Organization/user: saucam
• Repository: codeoid
• Workflow filename: release.yml
• Environment: (leave blank)

After that, every v* tag publishes automatically with no token. You can then revoke the NPM_TOKEN secret and flip your npm 2FA back to "Authorization and writes" — the token no longer matters.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated npm package publishing workflow to use GitHub OIDC Trusted Publishing and include provenance attestation on published packages for enhanced supply chain security verification.

[coderabbitai]

📝 Walkthrough

Walkthrough

The npm publish workflow in .github/workflows/release.yml is updated to use GitHub OIDC Trusted Publishing. A new step upgrades npm to the latest version before publishing (for Node 22 compatibility), and the publish step now runs npm publish --provenance --access public without NODE_AUTH_TOKEN.

Changes

npm OIDC Trusted Publishing migration

Layer / File(s)	Summary
npm upgrade and OIDC publish step .github/workflows/release.yml	Adds a step that runs npm install -g npm@latest prior to publishing, and replaces the existing publish step to use npm publish --provenance --access public authenticated via the GitHub id-token, removing the previous NODE_AUTH_TOKEN secret reference.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: switching npm publish authentication from token-based to OIDC Trusted Publishing, which directly aligns with the changeset in .github/workflows/release.yml.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/npm-trusted-publishing

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.61%. Comparing base (f5f46e9) to head (dfc0a55).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #25   +/-   ##
=======================================
  Coverage   80.61%   80.61%           
=======================================
  Files          45       45           
  Lines        4782     4782           
=======================================
  Hits         3855     3855           
  Misses        927      927           

Flag	Coverage Δ
daemon	80.61% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 29-33: The "Upgrade npm for Trusted Publishing" step in the
release workflow is using npm@latest which causes non-deterministic release
behavior when new npm versions are published. Replace npm@latest with a pinned
version number (use npm@11.5.1 or a validated patch version of that release) in
the npm install -g command to ensure consistent and reproducible releases.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ed83d42b-91a6-49b0-b765-4c1a97f47125

📥 Commits

Reviewing files that changed from the base of the PR and between f5f46e9 and dfc0a55.

📒 Files selected for processing (1)

• .github/workflows/release.yml

[coderabbitai]

🩺 Stability & Availability | 🟠 Major

🧩 Analysis chain

🌐 Web query:

What is the minimum npm CLI version required for npm Trusted Publishing with GitHub Actions OIDC, and are there any known caveats for npm 11.x on Node 22?

💡 Result:

The minimum npm CLI version required for npm Trusted Publishing with GitHub Actions OIDC is 11.5.1 [1][2][3]. Regarding Node 22 and npm 11.x, there are no inherent incompatibilities between them; rather, the caveat is that Node 22 does not ship with the required npm version (it includes an older npm 10.x version by default) [4]. Consequently, attempting to use Trusted Publishing directly on a default Node 22 environment will fail, often resulting in a misleading "404" error during the publish step [5][4]. To use Trusted Publishing while remaining on Node 22, you must explicitly upgrade the npm CLI within your workflow before running the publish command [5][6][4]: - run: npm install -g npm@latest Alternatively, you can switch to Node 24, which is bundled with a sufficiently recent version of the npm CLI [5][3][4]. Ensure your workflow also includes the required permissions: permissions: id-token: write contents: read Finally, note that Trusted Publishing is only supported on supported cloud providers (such as GitHub-hosted runners) and does not support self-hosted runners [1][6]. Ensure all configuration fields—such as the repository, workflow filename, and environment name—match exactly, as these are case-sensitive and mismatches may also cause authentication failures [1][3][6][4].

Citations:

• 1: https://docs.npmjs.com/trusted-publishers/
• 2: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/
• 3: https://github.com/npm/documentation/blob/main/content/packages-and-modules/securing-your-code/trusted-publishers.mdx
• 4: https://varstatt.com/jurij/p/npm-trusted-publishing-from-github-actions
• 5: https://stackoverflow.com/questions/79952803/why-am-i-getting-a-404-when-i-use-trusted-publishing-to-publish-from-github-acti
• 6: https://datafrog.io/blog/npm-trusted-publishing-github-actions-without-npm-token

---

Pin npm to a deterministic version instead of latest.

Line 32 makes release behavior drift over time; a new npm release can break publishing unexpectedly. The minimum version required for OIDC Trusted Publishing is 11.5.1—pin to this or a validated patch version on that line rather than chasing latest.

Suggested change

-      - name: Upgrade npm for Trusted Publishing
-        run: npm install -g npm@latest
+      - name: Upgrade npm for Trusted Publishing
+        run: npm install -g npm@11.5.1

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 32-32: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile

(adhoc-packages)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 29 - 33, The "Upgrade npm for
Trusted Publishing" step in the release workflow is using npm@latest which
causes non-deterministic release behavior when new npm versions are published.
Replace npm@latest with a pinned version number (use npm@11.5.1 or a validated
patch version of that release) in the npm install -g command to ensure
consistent and reproducible releases.

Source: Linters/SAST tools