Update to OIDC publishing

[carlansley]

Fixes #99

[Copilot]

🟡 Changes recommended

Separate privileged publishing from pull-request tests and pin npm to tested versions.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates npm publishing to use OIDC trusted publishing while refreshing tooling and CI workflows.

Changes:

• Consolidates release and beta publishing.
• Updates dependencies, scripts, and lockfile.
• Modernizes ESLint, Node, npm, and CI setup.
• Expands published-bundle testing.

File summaries

File	Summary
package.json	Updates version, tooling, scripts, and dependencies.
package-lock.json	Refreshes dependency lock data.
eslint.config.mjs	Removes unused import-plugin configuration.
.github/workflows/publish.yml	Adds OIDC-based release and beta publishing.
.github/workflows/publish-beta.yml	Removes the superseded beta workflow.
.github/workflows/ci.yml	Updates npm setup and CI installation.
.github/workflows/check-published-scheduled.yml	Updates Node/npm setup for scheduled checks.

Review details

Suppressed comments (4)

.github/workflows/check-published-scheduled.yml:20

• Installing npm@latest makes the scheduled verification job non-reproducible and allows a future npm release to change registry or package-inspection behavior without a repository change. Pin npm to the tested version used by this project instead.

      - name: Update npm
        run: npm install --global npm@latest

.github/workflows/ci.yml:27

• Installing npm@latest makes CI depend on an unpinned external major version. A future npm release can stop supporting the Node 24 matrix or alter install behavior without a repository change; pin npm to the tested version used by this project instead.

      - name: Update npm
        run: npm install --global npm@latest

.github/workflows/ci.yml:56

• Installing npm@latest makes CI depend on an unpinned external major version. A future npm release can stop supporting the Node 24 matrix or alter install behavior without a repository change; pin npm to the tested version used by this project instead.

      - name: Update npm
        run: npm install --global npm@latest

.github/workflows/publish.yml:41

• Installing npm@latest makes the release authentication and publish behavior depend on an unpinned external major version. A future npm release can change trusted-publishing requirements or stop supporting the repository's Node 26 runtime without any repository change; pin npm to a tested version that meets the OIDC minimum instead.

      - name: Update npm
        run: npm install --global npm@latest

• Files reviewed: 6/7 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[le-cong]

lftm

[github-actions]

Beta Published - Install Command: npm install @checkdigit/typescript-config@10.2.2-PR.100-0799