From 0299ce8ab35777bea4ca515f42708d51675c589b Mon Sep 17 00:00:00 2001
From: Ryan Rasti <ryanrasti@protonmail.com>
Date: Thu, 6 Aug 2026 20:08:27 -0700
Subject: [PATCH] ci: publish to npm via trusted publishing (OIDC)

Also:
- fix the tg bin path
- bump node version and flake.lock versions

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/main.yml | 4 +---
 flake.lock                 | 6 +++---
 flake.nix                  | 2 +-
 package-lock.json          | 4 ++--
 package.json               | 4 ++--
 5 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b55c783a..bca6379e 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -67,6 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write   # for pushing the tag
+      id-token: write   # for npm trusted publishing (OIDC)
     steps:
       - uses: actions/checkout@v4
         with:
@@ -95,9 +96,6 @@ jobs:
             npm run build
             npm publish
           '
-        env:
-          # npm reads this as a config key — avoids writing ~/.npmrc.
-          NPM_CONFIG_//registry.npmjs.org/:_authToken: ${{ secrets.NODE_AUTH_TOKEN }}
       - name: Tag the release
         if: steps.v.outputs.release == 'true'
         run: |
diff --git a/flake.lock b/flake.lock
index 77972fb4..0578d48e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1775710090,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "lastModified": 1785967620,
+        "narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index be7db83c..83c7b544 100644
--- a/flake.nix
+++ b/flake.nix
@@ -14,7 +14,7 @@
       devShells = forAllSystems ({ pkgs }: {
         default = pkgs.mkShell {
           packages = with pkgs; [
-            nodejs_22
+            nodejs  # nixpkgs default = current LTS (24.x as of this lock)
             postgresql_17
             act  # run GitHub Actions workflows locally (needs Docker on host)
           ];
diff --git a/package-lock.json b/package-lock.json
index fb64198f..e2fef7ee 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "typegres",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "typegres",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "dependencies": {
         "camelcase": "^9.0.0"
       },
diff --git a/package.json b/package.json
index 03b4dc1f..f6b9cdbe 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "typegres",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.mts",
@@ -54,7 +54,7 @@
     }
   },
   "bin": {
-    "tg": "./dist/cli.mjs"
+    "tg": "dist/cli.mjs"
   },
   "files": [
     "dist"