Publish via npm Trusted Publishing (OIDC) for provenance

[kin0992]

Problem

Published packages (e.g. @kin0992/oxc-config@0.3.0) have no provenance — the registry's attestation endpoint returns Not found and the #37 release log never printed a "Signed provenance statement".

Root cause, from the release log:

• The Configure npm scope auth step wrote the npm token into .npmrc, so changeset publish authenticated by token.
• changeset publish did not produce provenance under that path, despite NPM_CONFIG_PROVENANCE: true and publishConfig.provenance: true.
• changesets/action even reported OIDC is available - using npm trusted publishing, but the on-disk token overrode it.

Change

Switch to pure npm Trusted Publishing (OIDC):

• Remove the Configure npm scope auth step (no token on disk).
• Remove NODE_AUTH_TOKEN from the publish env.
• Keep id-token: write and NPM_CONFIG_PROVENANCE.

npm then exchanges the workflow's id-token for a short-lived credential and signs provenance automatically.

Required manual step before merging / next release

A Trusted Publisher must be configured on npmjs.org for each package, or the next publish will fail auth:

npmjs.org → each of @kin0992/{oxc-config,skills,tsconfig,vitest-config} → Settings → Trusted Publisher → GitHub Actions → owner kin0992, repo dev-toolkit, workflow release.yml.

Provenance attaches on the next version bump; existing 0.3.0 can't be back-filled.

npm_token secret / registry-url input are left declared (marked deprecated) for backward compatibility with any other callers.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5f7a088

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

🍹 preview on dev-toolkit-infra/prod

Pulumi report

View in Pulumi Cloud

  Previewing update (prod)

View Live: https://app.pulumi.com/kin0992/dev-toolkit-infra/prod/previews/6c5d1b21-64e2-469e-8107-2020e1304041

pulumi:pulumi:Stack: (same)
  [urn=urn:pulumi:prod::dev-toolkit-infra::pulumi:pulumi:Stack::dev-toolkit-infra-prod]
  - github:index/actionsSecret:ActionsSecret: (delete)
      [id=dev-toolkit:NPM_TOKEN]
      [urn=urn:pulumi:prod::dev-toolkit-infra::github:index/actionsSecret:ActionsSecret::npm-token]
      [provider=urn:pulumi:prod::dev-toolkit-infra::pulumi:providers:github::default_6_14_0::b8bd2d4c-683e-4fa4-bf68-03f6724778ff]
      repository: "dev-toolkit"
      secretName: "NPM_TOKEN"
      value     : [secret]
  --outputs:--
~ branchProtection: {
      allowsDeletions              : false
      allowsForcePushes            : false
      enforceAdmins                : false
      id                           : "BPR_kwDOSO32N84Eix0X"
      lockBranch                   : false
      pattern                      : "main"
      repositoryId                 : "R_kgDOSO32Nw"
      requireConversationResolution: true
      requireSignedCommits         : false
      requiredLinearHistory        : true
      requiredPullRequestReviews   : [
          [0]: {
              dismissStaleReviews         : true
              dismissalRestrictions       : 
              pullRequestBypassers        : 
              requireCodeOwnerReviews     : false
              requireLastPushApproval     : false
              requiredApprovingReviewCount: 0
              restrictDismissals          : false
          }
      ]
      requiredStatusChecks         : [
          [0]: {
              contexts: [
                  [0]: "Static Analysis (self)"
              ]
              strict  : true
          }
      ]
      urn                          : "urn:pulumi:prod::dev-toolkit-infra::github:index/branchProtection:BranchProtection::main-protection"
  }
~ repo            : {
      allowAutoMerge                     : true
      allowForking                       : true
      allowMergeCommit                   : false
      allowRebaseMerge                   : false
      allowSquashMerge                   : true
      allowUpdateBranch                  : true
      archiveOnDestroy                   : true
      archived                           : false
      defaultBranch                      : "main"
      deleteBranchOnMerge                : true
      description                        : "Platform Engineering toolkit: reusable GitHub Actions, AI Skills, and shared TypeScript configs."
      etag                               : "W/\"5df06006d8a40dbcc2919dc31f9e98b8e46e0707f9c32441b6845789c67089ac\""
      fork                               : "false"
      fullName                           : "kin0992/dev-toolkit"
      gitCloneUrl                        : "git://github.com/kin0992/dev-toolkit.git"
      hasDiscussions                     : false
      hasDownloads                       : false
      hasIssues                          : false
      hasProjects                        : false
      hasWiki                            : false
      htmlUrl                            : "https://github.com/kin0992/dev-toolkit"
      httpCloneUrl                       : "https://github.com/kin0992/dev-toolkit.git"
      id                                 : "dev-toolkit"
      ignoreVulnerabilityAlertsDuringRead: false
      isTemplate                         : false
      mergeCommitMessage                 : "PR_TITLE"
      mergeCommitTitle                   : "MERGE_MESSAGE"
      name                               : "dev-toolkit"
      nodeId                             : "R_kgDOSO32Nw"
      primaryLanguage                    : "JavaScript"
      private                            : false
      repoId                             : 1223554615
      securityAndAnalysis                : {
          advancedSecurity                 : 
          codeSecurity                     : 
          secretScanning                   : {
              status: "enabled"
          }
          secretScanningAiDetection        : 
          secretScanningNonProviderPatterns: 
          secretScanningPushProtection     : {
              status: "enabled"
          }
      }
      squashMergeCommitMessage           : "PR_BODY"
      squashMergeCommitTitle             : "PR_TITLE"
      sshCloneUrl                        : "git@github.com:kin0992/dev-toolkit.git"
      svnUrl                             : "https://github.com/kin0992/dev-toolkit"
      topics                             : [
          [0]: "agent-skills"
          [1]: "changesets"
          [2]: "claude-code"
          [3]: "copilot-cli"
          [4]: "github-actions"
          [5]: "marketplace"
          [6]: "platform-engineering"
          [7]: "pnpm"
          [8]: "pulumi"
          [9]: "turborepo"
          [10]: "typescript"
      ]
      urn                                : "urn:pulumi:prod::dev-toolkit-infra::github:index/repository:Repository::dev-toolkit"
      visibility                         : "public"
      vulnerabilityAlerts                : true
      webCommitSignoffRequired           : false
  }
Resources:
  - 1 to delete
  6 unchanged