From bf30c586eb29926467886403bbc17cb66716ac46 Mon Sep 17 00:00:00 2001
From: Anton Pascal <anton-pascal@users.noreply.github.com>
Date: Wed, 18 Feb 2026 21:38:26 +0000
Subject: [PATCH] fix: use OIDC trusted publishers instead of npm token
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The npm package has trusted publishers (OIDC) configured.
Remove manual token auth — let GitHub Actions OIDC handle it.
---
 .github/workflows/release.yml | 22 +++-------------------
 1 file changed, 3 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a03dab04..99a196a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,9 +42,7 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-
-      - name: Configure npm auth
-        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
+          registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -54,13 +52,6 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-      - name: Debug auth
-        run: |
-          echo "npm version: $(npm --version)"
-          echo "node version: $(node --version)"
-          npm whoami 2>&1 || echo "whoami failed"
-          cat ~/.npmrc | sed 's/npm_[a-zA-Z0-9]*/npm_REDACTED/g'
-
       - name: Bump & publish core
         if: inputs.package == 'core' || inputs.package == 'both'
         working-directory: packages/core
@@ -71,18 +62,11 @@ jobs:
 
           bun run build
 
-          echo "📋 Package contents:"
-          npm pack --dry-run 2>&1 || true
-
           if [ "${{ inputs.dry-run }}" = "true" ]; then
             echo "🏜️ Dry run — would publish @pascal-app/core@$VERSION"
             npm publish --dry-run --access public
           else
-            npm publish --access public --loglevel verbose 2>&1 || {
-              echo "❌ Publish failed, dumping debug log:"
-              cat ~/.npm/_logs/*-debug-0.log 2>/dev/null | tail -50
-              exit 1
-            }
+            npm publish --access public --provenance
             echo "📦 Published @pascal-app/core@$VERSION"
           fi
 
@@ -100,7 +84,7 @@ jobs:
             echo "🏜️ Dry run — would publish @pascal-app/viewer@$VERSION"
             npm publish --dry-run --access public
           else
-            npm publish --access public
+            npm publish --access public --provenance
             echo "📦 Published @pascal-app/viewer@$VERSION"
           fi