ci(release): switch npm publish to Trusted Publishers (OIDC), drop NPM_TOKEN

[kalwalt]

Summary

Fixes #194. The NPM_TOKEN secret (classic npm auth token) expired and broke the last release's publish step. npm Trusted Publishers is now configured for @webarkit/jsfeat-next on npmjs.com; this switches release.yml to use it.

• Removed NODE_AUTH_TOKEN from the "Publish to npm" step. id-token: write was already present at the workflow level (added for --provenance), so the token was the only remaining blocker — leaving it in would keep shadowing the OIDC exchange regardless of what's configured on npm's side.
• Added an "Update npm for trusted-publishing support" step (npm install -g npm@latest) right before publish: Trusted Publishers needs npm ≥ 11.5.1, and Node 24.18.0 (pinned in .nvmrc) bundles npm 10.9.4. Only the publish step needs the newer CLI.
• Updated MAINTAINERS.md's release runbook: replaced the NPM_TOKEN one-time-setup section with the Trusted Publisher configuration steps.

Testing

This can't be exercised by CI (no tag push happens on this PR) — verification is a real tag push or workflow_dispatch re-run against an existing tag, per #194's acceptance criteria, once this merges and a release is actually cut. Reviewed the diff for correct YAML indentation (matches the file's existing step structure) and confirmed prettier --check passes on both changed files.

Closes #194.

[qodo-code-review]

PR Summary by Qodo

Switch npm releases to OIDC Trusted Publishing

🐞 Bug fix ⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Replaces expired npm secret authentication with OIDC-backed Trusted Publishing.
• Upgrades npm immediately before publishing to satisfy Trusted Publisher requirements.
• Documents npm-side publisher setup and authentication troubleshooting.

Diagram

sequenceDiagram
    actor Maintainer
    participant Workflow as Release Workflow
    participant CLI as npm CLI 11+
    participant OIDC as GitHub OIDC
    participant Registry as npm Registry
    Maintainer->>Workflow: Push tag or dispatch
    Workflow->>CLI: Upgrade then publish
    CLI->>OIDC: Request identity token
    OIDC-->>CLI: Return short-lived token
    CLI->>Registry: Exchange identity and publish
    Registry-->>CLI: Confirm package

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin a supported npm 11 version

• ➕ Makes the release toolchain reproducible across runs
• ➕ Avoids unexpected behavior from future npm major releases
• ➖ Requires periodic maintenance as Trusted Publishing requirements evolve
• ➖ May miss npm publishing fixes available in newer releases

Recommendation: The OIDC migration is preferable to restoring a long-lived npm token because it removes secret expiration and rotation risks. Installing npm only before publishing also preserves the pinned build and test toolchain; however, pinning a supported npm 11 release or major could reduce release-time drift compared with npm@latest.

Files changed (2) +22 / -12

Bug fix (1) +13 / -2

release.ymlPublish releases through npm Trusted Publishers +13/-2

Publish releases through npm Trusted Publishers

• Upgrades npm immediately before publishing so the CLI supports Trusted Publishing. Removes NODE_AUTH_TOKEN, allowing npm to exchange the workflow's GitHub OIDC identity for a short-lived publish credential while retaining provenance.

.github/workflows/release.yml

Documentation (1) +9 / -10

MAINTAINERS.mdDocument Trusted Publisher release setup +9/-10

Document Trusted Publisher release setup

• Replaces NPM_TOKEN creation and rotation instructions with npm Trusted Publisher configuration details. Documents required repository and workflow identifiers, OIDC permissions, CLI requirements, and authentication troubleshooting.

MAINTAINERS.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Required publish permission omitted ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The Trusted Publisher setup instructions omit the required “Allowed actions” selection, so a
publisher created or recreated after May 20, 2026 cannot be configured from the runbook as written.
The configuration must explicitly allow npm publish for this workflow’s publish command.

Code

MAINTAINERS.md[R107-110]

+   - **Provider:** GitHub Actions
+   - **Repository:** `webarkit/jsfeatNext`
+   - **Workflow filename:** `release.yml`
+   - **Environment:** leave blank unless the workflow is later scoped to a GitHub Environment

Evidence

The runbook lists Provider, Repository, Workflow filename, and Environment but no Allowed actions
setting. npm’s current documentation states that Allowed actions is required, at least one action
must be selected, and configurations created after May 20, 2026 require an explicit selection.

MAINTAINERS.md[106-111]
.github/workflows/release.yml[132-141]
🌐 npm documents “Allowed actions” as required and says publishers created after May 20, 2026 must explicitly select npm publish, npm stage publish, or both.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The npm Trusted Publisher runbook omits the required **Allowed actions** field. Add an instruction to select `npm publish`, matching the command used by the release workflow.

## Issue Context
npm requires Trusted Publisher configurations created after May 20, 2026 to explicitly allow at least one action. This workflow uses `npm publish`, not staged publishing.

## Fix Focus Areas
- MAINTAINERS.md[106-111]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 27 rules

✅ Skills: license-header-adder

✅ Web pages:

  🌐 Trusted publishing for npm packages | npm Docs

  🌐 Using private packages in a CI/CD workflow | npm Docs

  🌐 npm-trust | npm Docs

  +6 more

Review mode: ⚖️ Balanced: This changes release authentication and CI publishing behavior through OIDC, npm tooling, and permissions, making it security- and deployment-sensitive despite the small diff.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗