From 4ab921047e4edc8008158974cdc1f940e7d0a48d Mon Sep 17 00:00:00 2001
From: Khaliq <khaliqgant@gmail.com>
Date: Sat, 18 Jul 2026 13:47:36 +0200
Subject: [PATCH] ci: use npm OIDC trusted publishing instead of a publish
 token

Matches the shape used by relayfile, relaycron, and relayflows: tokenless
auth via `id-token: write`, with the registry exchanging a short-lived
GitHub OIDC token.

- Remove the `NODE_AUTH_TOKEN` env from the publish step
- Remove the "Require NPM_TOKEN" guard step
- Pin npm to the 11 line (OIDC trusted publishing needs >= 11.5.1)
- Align the dry-run invocation with the reference repos (--tag passed)
- README documents the trusted-publisher setup and provenance

package.json already matched the reference convention (repository set,
publishConfig.access public, license, files), so it needs no change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 35 +++++++++++++++--------------------
 README.md                     | 12 ++++++++----
 2 files changed, 23 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e5955d9..7e1806a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,12 +1,15 @@
 name: Publish
 
-# Manual-dispatch only, and inert until the repository owner supplies the
-# `NPM_TOKEN` secret. Nothing here publishes on push or on merge.
+# Manual-dispatch only. Nothing here publishes on push or on merge.
 #
-# The `@agent-relay` npm scope is owned outside this repository, so a scope
-# grant plus the token must be in place before a real (non-dry-run) publish can
-# succeed. Until then the guard below fails the job with an explanatory message
-# rather than attempting to publish.
+# Authentication is npm OIDC trusted publishing — tokenless. There is no
+# NPM_TOKEN and no NODE_AUTH_TOKEN: the `id-token: write` permission below lets
+# the runner exchange a short-lived GitHub OIDC token with the registry.
+#
+# A real publish therefore requires the repository owner to configure this repo
+# and this workflow path as a "trusted publisher" for the package on npmjs.org.
+# That configuration is the OIDC equivalent of granting a token, and it is the
+# owner's step. Until it exists, a non-dry-run publish fails at the registry.
 
 on:
   workflow_dispatch:
@@ -63,17 +66,11 @@ jobs:
           cache: npm
           registry-url: "https://registry.npmjs.org"
 
-      - name: Require NPM_TOKEN for a real publish
-        if: ${{ github.event.inputs.dry_run != 'true' }}
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          if [ -z "${NPM_TOKEN}" ]; then
-            echo "::error::NPM_TOKEN is not configured. A real publish needs the"
-            echo "::error::repository owner to add the secret and grant this repo"
-            echo "::error::publish rights on the @agent-relay npm scope."
-            exit 1
-          fi
+      # OIDC trusted publishing needs npm >= 11.5.1. Pinned to the 11 line
+      # rather than @latest on purpose: npm 12 requires Node >= 22.22.2, which
+      # would break against the Node 22 pinned above.
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@11
 
       - run: npm ci
 
@@ -101,13 +98,11 @@ jobs:
 
       - name: Dry run publish
         if: ${{ github.event.inputs.dry_run == 'true' }}
-        run: npm publish --access public --dry-run --ignore-scripts
+        run: npm publish --dry-run --access public --tag ${{ github.event.inputs.tag }} --ignore-scripts
 
       - name: Publish
         if: ${{ github.event.inputs.dry_run != 'true' }}
         run: npm publish --access public --provenance --tag ${{ github.event.inputs.tag }} --ignore-scripts
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Commit, tag, and release
         if: ${{ github.event.inputs.dry_run != 'true' }}
diff --git a/README.md b/README.md
index 033656d..9303b69 100644
--- a/README.md
+++ b/README.md
@@ -53,10 +53,14 @@ Requires Node.js 20 or newer.
 
 ## Releasing
 
-Publishing is manual-dispatch only, via the `Publish` workflow. It defaults to a
-dry run and requires an `NPM_TOKEN` secret configured by the repository owner
-before a real publish will run. Nothing publishes automatically on push or
-merge.
+Publishing is manual-dispatch only, via the `Publish` workflow, and defaults to
+a dry run. Nothing publishes automatically on push or merge.
+
+Authentication is npm OIDC trusted publishing — there is no publish token to
+store. A real publish requires the repository owner to register this repository
+and workflow as a trusted publisher for the package on npmjs.org; releases carry
+[provenance](https://docs.npmjs.com/generating-provenance-statements) attesting
+the commit and workflow they were built from.
 
 ## License