From 27766b9347353b1d022cd6a79664e02bf0f41e12 Mon Sep 17 00:00:00 2001
From: weisser-dev <erik@weisser.dev>
Date: Sun, 4 Oct 2026 06:01:26 +0200
Subject: [PATCH] ci(release): publish to npm with trusted publishing instead
 of a token

---
 .github/workflows/release.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 393f256..4249722 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -79,11 +79,14 @@ jobs:
         run: npm test
         working-directory: cli-tool
 
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 22 ships an older npm.
+      - name: Update npm for trusted publishing
+        run: npm install -g npm@11
+
+      # No token: npm authenticates through the GitHub OIDC identity (id-token: write).
       - name: Publish to npm
         run: npm publish --access public --provenance
         working-directory: cli-tool
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create git tag and release commit
         env: