From e6a546f68e1b27e887d4eb957a39a81a719df01f Mon Sep 17 00:00:00 2001
From: waterbang <hsb@truesightai.com>
Date: Sat, 19 Sep 2026 14:16:22 +0800
Subject: [PATCH] ci: publish npm package via Trusted Publishing (OIDC)

Grant id-token: write, upgrade npm to 11 and add --provenance so the
ts-publish-npm workflow can authenticate through the npmjs.com Trusted
Publisher for this repository. NPM_TOKEN stays only as a transitional
fallback; granular tokens expire after 90 days, which broke every npm
publish since v0.4.18.
---
 .github/workflows/ts-publish-npm.yml | 13 ++++++++++++-
 RELEASING.md                         | 11 +++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ts-publish-npm.yml b/.github/workflows/ts-publish-npm.yml
index cde7607..e9fc495 100644
--- a/.github/workflows/ts-publish-npm.yml
+++ b/.github/workflows/ts-publish-npm.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      # Required for npm Trusted Publishing (OIDC) and provenance attestations.
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -22,6 +24,12 @@ jobs:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
 
+      # Trusted Publishing needs npm >= 11.5.1; Node 20 ships npm 10.
+      - name: Upgrade npm for Trusted Publishing
+        run: |
+          npm install -g npm@11
+          npm --version
+
       - name: Validate version
         working-directory: ts
         run: |
@@ -58,8 +66,11 @@ jobs:
             echo "tag=latest" >> "$GITHUB_OUTPUT"
           fi
 
+      # Preferred auth is the npmjs.com Trusted Publisher for this workflow
+      # (no secret, no expiry). NPM_TOKEN is only a fallback while the trusted
+      # publisher is not configured yet; delete the secret once it is.
       - name: Publish to npm
         working-directory: ts
-        run: npm publish --tag ${{ steps.npm-tag.outputs.tag }} --access public
+        run: npm publish --tag ${{ steps.npm-tag.outputs.tag }} --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/RELEASING.md b/RELEASING.md
index 31d2f85..854d1fa 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -61,8 +61,15 @@ A commit is not permission to push a tag or publish. Confirm the matching CCCC
 release exists, candidate checks pass, and publication is authorized.
 
 - A stable `vX.Y.Z` tag triggers the Python and npm publishing workflows. They
-  check coordinated versions and run package tests before publishing. Required
-  repository secrets are `PYPI_API_TOKEN` and `NPM_TOKEN`.
+  check coordinated versions and run package tests before publishing. The
+  Python workflow requires the `PYPI_API_TOKEN` repository secret.
+- npm publishes through npm Trusted Publishing (OIDC): on npmjs.com, package
+  `cccc-sdk` → Settings → Trusted Publisher → GitHub Actions with owner
+  `ChesterRa`, repository `cccc-sdk`, workflow `ts-publish-npm.yml`, no
+  environment. This needs no secret and never expires. The `NPM_TOKEN` secret
+  is only a fallback while that publisher is not configured; npm granular
+  tokens expire after at most 90 days, so remove the secret once Trusted
+  Publishing works rather than rotating it.
 - Publish the same Rust version with `cargo publish --manifest-path rust/Cargo.toml
   --locked --registry crates-io`, using the maintainer's crates.io credentials.
 - Do not also publish Python/npm manually while their workflows are running.