chore: npm trusted publisher

.github/ActionsHowTo.md

@@ -84,6 +84,25 @@ This workflow runs three jobs.
 
 1. Runs semantic-release to create a new release
 
+## Publishing to npm with Trusted Publishers (publish.yml)
+
+We publish using npm Trusted Publishing (OIDC) instead of long-lived tokens. This removes the need to store `NPM_TOKEN` and improves security.
+
+One-time setup on npmjs.com (per package):
+- In your package's Settings → Publishing access, add a Trusted Publisher for GitHub Actions.
+- Select the repository and enter the workflow filename exactly as `.github/workflows/publish.yml`.
+- Optionally, in Settings → Publishing access, enable “Require two-factor authentication and disallow tokens”. This blocks traditional tokens but still allows OIDC.
+
+Workflow requirements already configured in `publish.yml`:
+- Top-level permissions include `id-token: write` and `contents: read`.
+- `actions/setup-node@v4` configures the npm registry.
+- npm is updated to latest to ensure npm 11.5.1+ for OIDC publish.
+- `npm publish` runs without `NODE_AUTH_TOKEN`.
+
+If you need to install private dependencies during publish, use a read-only token just for install and keep `npm publish` without a token. See npm docs for guidance.
+
+References: npm Trusted Publishers docs: https://docs.npmjs.com/trusted-publishers
+
 ## Workflow Triggers
 
 Triggers are what causes a workflow to run. These are the current triggers for each of our workflows.

.github/workflows/publish.yml

@@ -2,6 +2,9 @@ name: publish to npm
 # manually run this action using the GitHub UI
 # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
 on: workflow_dispatch
+permissions:
+    id-token: write
+    contents: read
 jobs:
     main:
         runs-on: ubuntu-latest
@@ -18,13 +21,14 @@ jobs:
                   node-version-file: '.nvmrc'
                   registry-url: 'https://registry.npmjs.org'
 
+            # Ensure npm 11.5.1+ for trusted publishing with OIDC
+            - name: ⬆️ Update npm
+              run: npm install -g npm@latest
+
             - name: Configure git user
               run: |
                   git config --global user.email ${{ github.actor }}@users.noreply.github.com
                   git config --global user.name ${{ github.actor }}
 
             - name: Publish to npm
               run: npm publish
-              env:
-                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-                  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}