From 7ebd8bdb542455fcd2bab1c618f27f3dc7df0242 Mon Sep 17 00:00:00 2001
From: Mike Little <mike@zed1.com>
Date: Tue, 18 Aug 2026 15:49:44 +0100
Subject: [PATCH] Publish to npm via trusted publishing instead of NPM_TOKEN

npm is now configured as a trusted publisher for this repo, so the OIDC exchange replaces the stored token. Upgrades npm to a version that supports trusted publishing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml |  9 ++++++---
 RELEASING.md                  | 15 ++++++---------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d92b974..9744f79 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,7 +1,8 @@
 name: Release
 
 # Publishes to npm when a GitHub Release is published.
-# See RELEASING.md for the full process and required NPM_TOKEN secret.
+# Authenticates to npm as a trusted publisher via OIDC (no token needed).
+# See RELEASING.md for the full process.
 on:
   release:
     types: [published]
@@ -21,6 +22,10 @@ jobs:
           node-version: 20
           registry-url: 'https://registry.npmjs.org'
 
+      # Trusted publishing via OIDC requires npm >= 11.5.1; Node 20 ships npm 10.
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
       - run: npm ci
 
       - name: Verify tag matches package.json version
@@ -42,5 +47,3 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/RELEASING.md b/RELEASING.md
index 64e51d5..a6e0c80 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -47,17 +47,14 @@ Publishing the release triggers `.github/workflows/release.yml`, which:
 - runs `npm audit` (advisory — does not block the release),
 - publishes to npm with [provenance](https://docs.npmjs.com/generating-provenance-statements).
 
-## One-time setup: the `NPM_TOKEN` secret
+## One-time setup: trusted publishing
 
-Publishing needs an npm access token stored as a repository secret named
-`NPM_TOKEN`:
+Publishing authenticates to npm as a
+[trusted publisher](https://docs.npmjs.com/trusted-publishers) via OIDC — no
+token or repository secret is required.
 
-1. On [npmjs.com](https://www.npmjs.com/) → **Access Tokens** → **Generate New
-   Token** → **Granular Access Token** (recommended) with **Read and write**
-   permission scoped to the `altis-cli` package. Use an **Automation** token so
-   it bypasses 2FA in CI.
-2. In GitHub: **Settings → Secrets and variables → Actions → New repository
-   secret**, name it `NPM_TOKEN`, and paste the token.
+The workflow grants `id-token: write` (for the OIDC exchange) and upgrades npm
+to a version new enough to support trusted publishing.
 
 Provenance additionally requires the repository to be public and the
 `repository` field in `package.json` to be set (both already true).