From ed54e1ca2de3efde1c649787788a4755671b11b6 Mon Sep 17 00:00:00 2001
From: humble-little-bear <retric@ckba.build>
Date: Thu, 8 Oct 2026 14:02:56 +0800
Subject: [PATCH] ci: publish canary releases via npm trusted publishing (#536)

The NPM_AUTH_TOKEN secret is rejected by the registry (E404 on PUT),
so switch canary-publish.yml to npm trusted publishing (GitHub OIDC):

- grant id-token: write (contents: read is all the job needs)
- run the job on Node 24, which bundles npm 11; guard that npm is
  >= 11.5.1 before publishing
- drop NODE_AUTH_TOKEN from the publish step so no stale token is used

Provenance is generated automatically. publish.yml is unchanged until
a trusted publisher is configured for it.
---
 .changeset/canary-trusted-publishing.md |  4 ++++
 .github/workflows/canary-publish.yml    | 21 +++++++++++++++------
 2 files changed, 19 insertions(+), 6 deletions(-)
 create mode 100644 .changeset/canary-trusted-publishing.md

diff --git a/.changeset/canary-trusted-publishing.md b/.changeset/canary-trusted-publishing.md
new file mode 100644
index 0000000..d10e989
--- /dev/null
+++ b/.changeset/canary-trusted-publishing.md
@@ -0,0 +1,4 @@
+---
+---
+
+ci: publish canary releases via npm trusted publishing (OIDC) on Node 24 instead of an npm token.
diff --git a/.github/workflows/canary-publish.yml b/.github/workflows/canary-publish.yml
index f5a8bb0..984428f 100644
--- a/.github/workflows/canary-publish.yml
+++ b/.github/workflows/canary-publish.yml
@@ -7,7 +7,8 @@ on:
       - '**/package.json'
 
 permissions:
-  contents: write
+  contents: read
+  id-token: write # npm trusted publishing (OIDC) + provenance
 
 jobs:
   canary:
@@ -23,7 +24,8 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          # Trusted publishing needs Node >= 22.14 and npm >= 11.5.1; Node 24 bundles npm 11.
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
@@ -45,8 +47,15 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - name: Canary release to npm
+      - name: Ensure npm supports trusted publishing
         run: |
-          npm publish --access public --tag canary
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+          node -v
+          if [ "$(node -p "require('semver').gte('$(npm -v)', '11.5.1')")" != "true" ]; then
+            npm install -g npm@^11.5.1
+          fi
+          npm -v
+
+      # Authenticates via npm trusted publishing (GitHub OIDC); no npm token is used.
+      # Provenance is generated automatically.
+      - name: Canary release to npm
+        run: npm publish --access public --tag canary