ci(release): finish migrating npm publish to trusted publishing

[RedStar071]

🔗 Linked issue

N/A — no tracking issue, this came out of a review of the release workflow's npm publishing setup.

🧭 Context

The npm Trusted Publisher is now configured on npmjs.com for all 4 @wolfstar/* packages. release.yml already had everything else trusted publishing (OIDC) needs: id-token: write on both the snapshot and release jobs, registry-url on actions/setup-node, and every package's package.json already carries the matching repository field plus publishConfig.access: "public" / publishConfig.provenance: true.

The only thing left over was NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }} in both jobs — a long-lived npm token kept as a standing secret for no benefit. changeset publish shells out to pnpm publish for this workspace (confirmed against getPublishTool.ts in changesets/changesets), and pnpm (since pnpm/pnpm#11495, included in the pnpm@11.24.0 this repo pins) always attempts OIDC first and only falls back to a static _authToken when trusted publishing isn't applicable. With the Trusted Publisher now set up, the token was never going to be used.

📚 Description

• Removed NODE_AUTH_TOKEN from the snapshot and release jobs' publish steps; NPM_CONFIG_PROVENANCE/publishConfig.provenance still cover provenance independently of the auth method.
• An earlier commit on this branch added an npm install -g npm@latest step to both jobs to "guarantee" the npm CLI version. Removed it again: changeset publish never invokes the npm binary here (it calls pnpm publish), and pnpm's OIDC exchange is its own implementation, independent of the globally installed npm CLI version — the step had no effect on the actual publish and its comment was misleading.
• Updated .changeset/README.md's setup/troubleshooting sections to describe the trusted-publisher configuration instead of the retired NPM_PUBLISH_TOKEN secret, including the steps to add a new package to it and a note on a known upstream npm CLI bug (npm/cli#8976) affecting multi-package OIDC publishes.
• Updated AGENTS.md, which still told contributors that releases authenticate via NPM_PUBLISH_TOKEN.

No behavior change is expected: publishing keeps working the same way, just authenticated via OIDC trusted publishing instead of a static token that pnpm was already bypassing.

Key changes

File	Change
.github/workflows/release.yml	Drop NODE_AUTH_TOKEN from both publish jobs (no npm CLI version bump needed)
.changeset/README.md	Replace NPM_PUBLISH_TOKEN secret docs with trusted-publisher setup/troubleshooting instructions
AGENTS.md	Stop referencing the retired NPM_PUBLISH_TOKEN secret

Once a release confirms the OIDC flow end-to-end, the NPM_PUBLISH_TOKEN secret itself can be deleted from repo/org settings.

Type of Change

• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation change
• Workflow / CI change

Pre-flight Checklist

• I have read the Contributing Guidelines (if applicable)
• My code follows the code style of this project
• I have added tests that prove my fix is effective or that my feature works — N/A, CI workflow config, not covered by the test suite
• New and existing unit tests pass locally with my changes — not run, no source code touched
• I have updated the documentation accordingly (.changeset/README.md, AGENTS.md)
• I added a changeset — not needed, no package version bump involved

Confidence Score: 5/5

Safe to merge.

Both prior comments are fully fixed in the current code: AGENTS.md now documents OIDC trusted publishing instead of NPM_PUBLISH_TOKEN, and the release workflow no longer installs the mutable npm@latest tag.

_{Reviews (2): Last reviewed commit: "docs(agents): stop pointing at the retir..." | Re-trigger Greptile}

[greptile-apps]

Greptile has paused reviews on this repository — it used its 100 free open-source review credits for this billing period. Reviews resume automatically on September 27. To continue before then, an organization admin can keep reviews running past the free credits — those bill as normal usage.

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/@wolfstar/plugin-api@77

pnpm add https://pkg.pr.new/@wolfstar/plugin-i18next@77

pnpm add https://pkg.pr.new/@wolfstar/plugin-logger@77

pnpm add https://pkg.pr.new/@wolfstar/plugin-subcommands-advanced@77

commit: bac016a

[RedStar071]

@greptile review

[RedStar071]

Resolving the two open threads from the last review — both underlying issues are fixed on this branch:

• Align release authentication guidance (.changeset/README.md:59): AGENTS.md no longer references NPM_PUBLISH_TOKEN, it now describes the OIDC trusted-publishing flow.
• Pin the npm version (release.yml:93): removed the npm install -g npm@latest step entirely rather than pinning it — changeset publish shells out to pnpm publish for this workspace, so the globally installed npm CLI is never invoked and the step had no effect either way.

Note for whoever picks this up next: Greptile is currently paused on this repo (out of free review credits until Sept 27), so no fresh confidence score is available — flagging in case a maintainer wants to enable paid usage or re-review manually before merging.