[nikhil-mittal-165]

⚠️ DO NOT MERGE YET

Each published package must first have a trusted publisher configured on npmjs.com (see Merge order). The title has a placeholder GUS id (W-00000000) that must be replaced before the PR title check passes.

Why

npm is ending publishes with bypass-2fa tokens in Jan 2027, so NPM_TOKEN publishing must move to Trusted Publishing (OIDC). The Platform CLI announcement names only forcedotcom/code-analyzer (token expires Nov 12, 2026); whether core's token is covered is unconfirmed. Core publishes 11 packages to npm via this workflow, so it needs the same migration.

What changed (publish-package-to-npm.yml, build-and-test-and-publish job)

• Add id-token: write / contents: read.
• Node 20 → 22 (Trusted Publishing needs Node >= 22.14.0) and install npm@11 (>= 11.5.1 to publish, >= 11.21.0 for OIDC dist-tag). Pinned to 11 for consistency with forcedotcom/code-analyzer, which must stay on npm 11 (npm 12 dropped shrinkwrap support).
• Remove the .npmrc NPM_TOKEN write. npm publish and npm dist-tag add now authenticate via OIDC.

Merge order

1. Platform CLI registers a trusted publisher on npmjs.com for each package this workflow publishes, against workflow file publish-package-to-npm.yml, with "Allow npm dist-tag" enabled:
   code-analyzer-core, engine-api, eslint-engine, eslint8-engine, flow-engine, pmd-engine, regex-engine, retirejs-engine, sfge-engine, apexguru-engine, uibundle-engine (all @salesforce/...).
2. Merge this PR.
3. Run a real (non-dry-run) release within 24 hours of step 1.

Open questions

• Does the 24-hour expiry apply per package? Does a release need to publish all 11?
• Build/test now runs on Node 22 instead of 20 (engines allows >=20). Not yet run in CI.
• --dry-run does not prove OIDC works; only a real publish does.

🤖 Generated with Claude Code

[git2gus]

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

[nikhil-mittal-165]

Self-review using the refreshed Code Analyzer regression-review skill.

Findings

No production-code defect found in the workflow diff. The Node/npm minimums, job-level id-token: write, token removal, and separate dist-tag permission match the current npm Trusted Publishing contract.

Manual validation before merge

Required:

• Confirm every package selected by this workflow has a trusted publisher configured for exactly forcedotcom/code-analyzer-core and publish-package-to-npm.yml, with both direct publish and dist-tag actions allowed. Configuration is per package.
• Run the workflow in dry-run mode and verify package selection, build/test, npm publish --dry-run, and the absence of post-release PR creation. Note that dry-run does not prove OIDC authorization.
• Perform the first real publish with one controlled package/version inside the npm configuration validation window. Verify the latest-beta publish, the explicit latest tag update, provenance, and post-release PR creation.
• Deliberately remove dist-tag permission in a disposable/test package or equivalent controlled setup and verify the job fails before reporting successful completion of the release.

Recommended:

• Pin or print the resolved npm 11 version in the job log so a future moving npm@11 cannot silently drop below the required dist-tag capability.
• After successful migration, verify the legacy write token is removed/restricted in npm and no workflow path still depends on NPM_TOKEN.

Evidence checked: complete workflow diff, downstream post-release job dependency, and current official npm/GitHub OIDC requirements. No live publish was performed by this review.

[nikhil-mittal-165]

Added the recommended npm version guard in e697718: the workflow now prints the resolved npm version and fails fast if it is below 11.21.0. The manual validation items (trusted publisher config, dry run, first real publish) are still outstanding.

🤖 Generated with Claude Code