ci(release): publish to npm through OIDC trusted publishing only

[amondnet]

Summary

The publish job ran actions/setup-node with registry-url only to write a registry .npmrc. That file reads NODE_AUTH_TOKEN, which no secret sets, so every publish ran with setup-node's placeholder token (XXXXX-XXXXX-XXXXX-XXXXX in the job env) alongside the OIDC exchange.

This PR removes that step. npm then authenticates through OIDC trusted publishing alone: id-token: write plus a trusted publisher configured on npmjs.com for each package. A package with no trusted publisher now fails to publish instead of falling back to a token.

Unchanged:

• npm ^11.5.1 is still installed, as OIDC requires it.
• --provenance stays.
• The registry defaults to https://registry.npmjs.org, so the unauthenticated npm view checks behave the same.

Before the next release of each package, configure a trusted publisher on npmjs.com (pleaseai/code-style, workflow release-please.yml) for:

• @pleaseai/prettier-config
• @pleaseai/editorconfig
• @pleaseai/ast-grep-config

@pleaseai/code-style 0.1.1 already published through OIDC with provenance in run 38536834166.

Related issue

Follow-up to #51 / #53.

Checklist

• PR title follows Conventional Commits
• Packages build (bun run build) — workflow-only change
• Lint/format pass (bun run lint, actionlint)
• Documentation updated if behavior changed
• No breaking change, or a BREAKING CHANGE: note is included

---

Summary by cubic

Removes the actions/setup-node step from the release publish job so npm authenticates solely through OIDC trusted publishing. The step only wrote an .npmrc that reads NODE_AUTH_TOKEN, which no secret sets, so npm was running with setup-node's placeholder token and a package without a trusted publisher silently fell back to it instead of failing.

Rollout

• Configure a trusted publisher on npmjs.com for @pleaseai/prettier-config, @pleaseai/editorconfig, and @pleaseai/ast-grep-config (workflow release-please.yml) before their next release.
• @pleaseai/code-style 0.1.1 already published through OIDC with provenance.

^{Written for commit 41744cc. Summary will update on new commits.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[cloudflare-workers-and-pages]

Deploying code-style with    Cloudflare Pages

Latest commit:	41744cc
Status:	✅  Deploy successful!
Preview URL:	https://b01c23b0.code-style.pages.dev
Branch Preview URL:	https://ci-npm-oidc-only.code-style.pages.dev

View logs

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[cubic-dev-ai]

No issues found across 1 file

Architecture diagram

sequenceDiagram
    participant GA as GitHub Actions
    participant RP as Release Please
    participant Mise as mise-action
    participant NPM as npm CLI
    participant OIDC as GitHub OIDC Provider
    participant NPMReg as registry.npmjs.org

    Note over GA,NPMReg: Release Publish Job - OIDC only

    GA->>GA: Checkout code
    GA->>GA: id-token: write permission
    GA->>Mise: Install toolchain (node.js)
    Mise-->>GA: node on PATH

    GA->>NPM: Install npm ^11.5.1
    Note over NPM: OIDC requires npm >= 11.5.1

    GA->>NPM: Run publish

    alt Trusted publisher configured (e.g. @pleaseai/code-style)
        NPM->>OIDC: Request OIDC token (id-token: write)
        OIDC-->>NPM: JWT with workflow identity + package name
        NPM->>NPMReg: npm publish --provenance
        Note over NPMReg: OIDC exchange validates trusted publisher
        NPMReg-->>NPM: 201 + provenance receipt
        NPM-->>GA: Success
    else No trusted publisher (e.g. @pleaseai/prettier-config)
        NPM->>OIDC: Request OIDC token
        OIDC-->>NPM: JWT with workflow identity
        NPM->>NPMReg: npm publish --provenance
        Note over NPMReg: No matching trusted publisher
        NPMReg-->>NPM: 401 Unauthorized
        NPM-->>GA: Fail (no NODE_AUTH_TOKEN fallback)
    end

Loading

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge with the stated trusted-publisher rollout requirement.

Summary

Removes setup-node from the publish job so it no longer creates token-based registry settings.

• npm releases now use OIDC without a token fallback.

_{Reviews (1) · Last reviewed commit: "ci(release): publish to npm through OIDC..." · Reviewed by Greptile}