From e58852cc09d1594f724bd020dad551be05628b70 Mon Sep 17 00:00:00 2001
From: hkonsti <45428767+hkonsti@users.noreply.github.com>
Date: Thu, 9 Jul 2026 13:55:29 -0700
Subject: [PATCH] ci: use npm OIDC trusted publishing for releases

Replaces the long-lived NPM_AUTH_TOKEN with npm's OIDC trusted
publishing. Adds id-token: write permission, upgrades npm to a version
that supports trusted publishing (>= 11.5.1), and drops the npm token
env vars. Lerna v9+ handles the OIDC exchange automatically.
---
 .github/workflows/publish.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d535470f..c0d7e557 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,9 +22,10 @@ jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write # Required for npm OIDC trusted publishing
     env:
-      NODE_AUTH_TOKEN: ${{secrets.NPM_AUTH_TOKEN}}
-      NPM_TOKEN: ${{secrets.NPM_AUTH_TOKEN}}
       GH_TOKEN: ${{secrets.PUBLISH_TOKEN}}
     steps:
       - uses: actions/checkout@v4
@@ -41,6 +42,8 @@ jobs:
           node-version: 22
           registry-url: 'https://registry.npmjs.org'
           cache: npm
+      # Trusted publishing requires npm >= 11.5.1; Node 22 ships npm 10.x
+      - run: npm install -g npm@latest
       - run: git config --global user.email "167322027+revideo-bot@users.noreply.github.com"
       - run: git config --global user.name "revideo-bot"
       - run: npm ci