ci: publish npm package via Trusted Publishing (OIDC)

.github/workflows/ts-publish-npm.yml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      # Required for npm Trusted Publishing (OIDC) and provenance attestations.
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -22,6 +24,12 @@ jobs:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
 
+      # Trusted Publishing needs npm >= 11.5.1; Node 20 ships npm 10.
+      - name: Upgrade npm for Trusted Publishing
+        run: |
+          npm install -g npm@11
+          npm --version
+
       - name: Validate version
         working-directory: ts
         run: |
@@ -58,8 +66,11 @@ jobs:
             echo "tag=latest" >> "$GITHUB_OUTPUT"
           fi
 
+      # Preferred auth is the npmjs.com Trusted Publisher for this workflow
+      # (no secret, no expiry). NPM_TOKEN is only a fallback while the trusted
+      # publisher is not configured yet; delete the secret once it is.
       - name: Publish to npm
         working-directory: ts
-        run: npm publish --tag ${{ steps.npm-tag.outputs.tag }} --access public
+        run: npm publish --tag ${{ steps.npm-tag.outputs.tag }} --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

RELEASING.md

@@ -61,8 +61,15 @@ A commit is not permission to push a tag or publish. Confirm the matching CCCC
 release exists, candidate checks pass, and publication is authorized.
 
 - A stable `vX.Y.Z` tag triggers the Python and npm publishing workflows. They
-  check coordinated versions and run package tests before publishing. Required
-  repository secrets are `PYPI_API_TOKEN` and `NPM_TOKEN`.
+  check coordinated versions and run package tests before publishing. The
+  Python workflow requires the `PYPI_API_TOKEN` repository secret.
+- npm publishes through npm Trusted Publishing (OIDC): on npmjs.com, package
+  `cccc-sdk` → Settings → Trusted Publisher → GitHub Actions with owner
+  `ChesterRa`, repository `cccc-sdk`, workflow `ts-publish-npm.yml`, no
+  environment. This needs no secret and never expires. The `NPM_TOKEN` secret
+  is only a fallback while that publisher is not configured; npm granular
+  tokens expire after at most 90 days, so remove the secret once Trusted
+  Publishing works rather than rotating it.
 - Publish the same Rust version with `cargo publish --manifest-path rust/Cargo.toml
   --locked --registry crates-io`, using the maintainer's crates.io credentials.
 - Do not also publish Python/npm manually while their workflows are running.