From 7071163584827e3c48edad79224dd50aa785e5e0 Mon Sep 17 00:00:00 2001
From: Atharva0506 <atharvan.coder@gmail.com>
Date: Wed, 5 Aug 2026 16:31:14 +0530
Subject: [PATCH 1/3] ci: migrate npm publish to Trusted Publishing (OIDC)

npm is deprecating bypass-2FA token publishing (phased out by Jan 2027),
so drop the NPMJS_TOKEN-based auth in favor of OIDC trusted publishing.
Requires npm >= 11.5.1, pinned via npm install -g npm@11.5.1.
---
 .github/workflows/version-release.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/version-release.yml b/.github/workflows/version-release.yml
index b682aee5..895559ac 100644
--- a/.github/workflows/version-release.yml
+++ b/.github/workflows/version-release.yml
@@ -175,6 +175,9 @@ jobs:
       - name: Run linting
         run: pnpm run lint
 
+      - name: Update npm for Trusted Publishing
+        run: npm install -g npm@11.5.1
+
       - name: Sync version from VERSION file
         run: |
           VERSION="${{ needs.release.outputs.version }}"
@@ -187,8 +190,6 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_TOKEN }}
 
       - name: Publish Summary
         run: |

From c4580d794e8032088810726fceb6c06251f8fd6f Mon Sep 17 00:00:00 2001
From: Atharva0506 <atharvan.coder@gmail.com>
Date: Wed, 5 Aug 2026 16:54:40 +0530
Subject: [PATCH 2/3] ci: split publish into build and publish jobs

Untrusted code (pnpm install, lint) previously ran in the same job as
id-token: write, so a compromised dependency could have exfiltrated the
OIDC token before the publish step ran. Build and pack the tarball in a
job with no token access, then publish it from a minimal job that only
handles the tarball and the actual publish call.
---
 .github/workflows/version-release.yml | 45 +++++++++++++++++++++------
 1 file changed, 36 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/version-release.yml b/.github/workflows/version-release.yml
index 895559ac..4d2ae3b9 100644
--- a/.github/workflows/version-release.yml
+++ b/.github/workflows/version-release.yml
@@ -141,14 +141,13 @@ jobs:
             echo "- **GitHub Release:** ✗ (no draft found)" >> $GITHUB_STEP_SUMMARY
           fi
 
-  publish:
+  build:
     needs: release
     if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.release.outputs.released == 'true' }}
     runs-on: ubuntu-latest
 
     permissions:
       contents: read
-      id-token: write
 
     steps:
       - name: Checkout code
@@ -166,7 +165,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -175,9 +173,6 @@ jobs:
       - name: Run linting
         run: pnpm run lint
 
-      - name: Update npm for Trusted Publishing
-        run: npm install -g npm@11.5.1
-
       - name: Sync version from VERSION file
         run: |
           VERSION="${{ needs.release.outputs.version }}"
@@ -185,11 +180,43 @@ jobs:
           npm version "$VERSION" --no-git-tag-version --allow-same-version
           echo "✓ package.json version set to $VERSION"
 
-      - name: Verify package contents
-        run: npm pack --dry-run
+      - name: Pack package
+        run: npm pack --pack-destination /tmp/pack
+
+      - name: Upload package tarball
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: npm-package
+          path: /tmp/pack/*.tgz
+          retention-days: 1
+
+  publish:
+    needs: [release, build]
+    if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.release.outputs.released == 'true' }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Download package tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: npm-package
+          path: /tmp/pack
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Update npm for Trusted Publishing
+        run: npm install -g npm@11.5.1
 
       - name: Publish to npm
-        run: npm publish --provenance --access public
+        run: npm publish /tmp/pack/*.tgz --provenance --access public
 
       - name: Publish Summary
         run: |

From 3f7d7e6c894bc2c7fc4dde99b863160277fb972f Mon Sep 17 00:00:00 2001
From: Atharva0506 <atharvan.coder@gmail.com>
Date: Wed, 5 Aug 2026 17:04:28 +0530
Subject: [PATCH 3/3] ci: pin actions/setup-node to an immutable commit SHA

---
 .github/workflows/version-release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/version-release.yml b/.github/workflows/version-release.yml
index 4d2ae3b9..910f617e 100644
--- a/.github/workflows/version-release.yml
+++ b/.github/workflows/version-release.yml
@@ -162,7 +162,7 @@ jobs:
           run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           cache: 'pnpm'
@@ -207,7 +207,7 @@ jobs:
           path: /tmp/pack
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'