From a9cd625fb6ead71a730148d75f7f1dd578319181 Mon Sep 17 00:00:00 2001
From: will wade <willwade@gmail.com>
Date: Sat, 29 Aug 2026 13:59:05 +0000
Subject: [PATCH] fix: npm publish via trusted publishing (OIDC), not a token
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The token-based publish failed on the v0.0.36/v0.1.1 releases with
404-on-PUT — the NPM_TOKEN secret has been dead since May (npm returns
404 rather than 401 for bad auth to avoid leaking package existence).
npm has deprecated registry tokens in favour of trusted publishing,
which the PyPI workflow here already uses.

- permissions: id-token: write; no NODE_AUTH_TOKEN anywhere
- node 24.x (npm 11.5.1+ handles the OIDC exchange automatically)
- checkout@4/setup-node@4 (v3 actions are sunset)
- workflow_dispatch with a tag input so a release whose npm leg failed
  (like v0.1.1) can be republished without cutting a new tag

Requires the matching trusted-publisher registration on npmjs.com for
worldalphabets: AACTools/WorldAlphabets, workflow npm-publish.yml.

Signed-off-by: will wade <willwade@gmail.com>
---
 .github/workflows/npm-publish.yml | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 3912938b..79067105 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -3,22 +3,39 @@ name: Publish to npm
 on:
   release:
     types: [created]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to publish (e.g. v0.1.1)"
+        required: true
+        type: string
+
+permissions:
+  id-token: write # npm trusted publishing (OIDC) — no registry token
+  contents: read
 
 jobs:
   build:
+    name: Build and publish (trusted publishing)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
       - name: Update version in package.json
         run: |
-          VERSION=$(echo "${{ github.event.release.tag_name }}" | sed 's/^v//')
+          VERSION=$(echo "${{ inputs.tag || github.event.release.tag_name }}" | sed 's/^v//')
           sed -i "s/\"version\": \"{{version}}\"/\"version\": \"$VERSION\"/g" package.json
-      - uses: actions/setup-node@v3
+
+      - uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          node-version: '24.x' # npm 11.5.1+ required for trusted publishing
           registry-url: 'https://registry.npmjs.org'
+
       - run: npm install
       - run: npm test
+      # No NODE_AUTH_TOKEN: auth comes from the GitHub OIDC token via the
+      # trusted publisher registered for this package on npmjs.com
+      # (AACTools/WorldAlphabets, workflow npm-publish.yml).
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}