From c788c981ee7d7a0bf9278726d319cf6a2dda53cc Mon Sep 17 00:00:00 2001
From: Anton Pascal <anton-pascal@users.noreply.github.com>
Date: Wed, 18 Feb 2026 20:28:43 +0000
Subject: [PATCH] ci: use OIDC trusted publishing instead of NPM_TOKEN

- Added environment: npm + id-token: write permission
- Added --provenance flag for supply chain security
- Removed NPM_TOKEN secret dependency
- Added setup-node with registry-url for OIDC auth
---
 .github/workflows/release.yml | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5906e789..57c7655c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,8 +28,10 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    environment: npm
     permissions:
       contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -37,12 +39,14 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
 
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: "https://registry.npmjs.org"
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Configure npm auth
-        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
-
       - name: Configure git
         run: |
           git config user.name "github-actions[bot]"
@@ -51,6 +55,8 @@ jobs:
       - name: Bump & publish core
         if: inputs.package == 'core' || inputs.package == 'both'
         working-directory: packages/core
+        env:
+          NODE_AUTH_TOKEN: ""
         run: |
           npm version ${{ inputs.bump }} --no-git-tag-version
           VERSION=$(node -p "require('./package.json').version")
@@ -60,15 +66,17 @@ jobs:
 
           if [ "${{ inputs.dry-run }}" = "true" ]; then
             echo "🏜️ Dry run — would publish @pascal-app/core@$VERSION"
-            npm publish --dry-run
+            npm publish --dry-run --access public
           else
-            npm publish --access public
+            npm publish --access public --provenance
             echo "📦 Published @pascal-app/core@$VERSION"
           fi
 
       - name: Bump & publish viewer
         if: inputs.package == 'viewer' || inputs.package == 'both'
         working-directory: packages/viewer
+        env:
+          NODE_AUTH_TOKEN: ""
         run: |
           npm version ${{ inputs.bump }} --no-git-tag-version
           VERSION=$(node -p "require('./package.json').version")
@@ -78,9 +86,9 @@ jobs:
 
           if [ "${{ inputs.dry-run }}" = "true" ]; then
             echo "🏜️ Dry run — would publish @pascal-app/viewer@$VERSION"
-            npm publish --dry-run
+            npm publish --dry-run --access public
           else
-            npm publish --access public
+            npm publish --access public --provenance
             echo "📦 Published @pascal-app/viewer@$VERSION"
           fi