From 62e5794605acbdca25190bd36ed9b6cff0b1face Mon Sep 17 00:00:00 2001
From: sjoerdbeentjes <11621275+sjoerdbeentjes@users.noreply.github.com>
Date: Tue, 14 Jul 2026 11:54:41 +0200
Subject: [PATCH] ci: use npm trusted publishing for releases

npm now authenticates the publish step via OIDC (trusted publishing)
instead of a long-lived NPM_TOKEN. Drop the token env vars and the
explicit provenance flag (provenance is automatic under trusted
publishing), and upgrade the global npm to >= 11.5.1 since that is the
minimum version trusted publishing requires and Node 22 ships npm 10.x.
---
 .github/workflows/release.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a66d792..d592583 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ concurrency: release-${{ github.ref }}
 permissions:
   contents: write # create the version PR / push tags
   pull-requests: write # open and update the version PR
-  id-token: write # npm provenance
+  id-token: write # OIDC token for npm trusted publishing (+ automatic provenance)
 
 jobs:
   release:
@@ -28,6 +28,10 @@ jobs:
           node-version-file: .nvmrc
           cache: pnpm
 
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 22 ships npm 10.x.
+      # `changeset publish` shells out to this global npm to publish each package.
+      - run: npm install -g npm@latest
+
       - run: pnpm install --frozen-lockfile
 
       - name: Create version PR or publish
@@ -43,7 +47,6 @@ jobs:
           commit: 'chore: version packages'
           title: 'chore: version packages'
         env:
+          # No NPM_TOKEN: auth is handled by npm trusted publishing via the OIDC
+          # id-token above, and provenance is generated automatically.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true