Switch publish workflow to npm Trusted Publishing (OIDC)

The package is now established on npmjs.org with a Trusted Publisher
binding to this workflow. Drops the NPM_TOKEN dependency:

- Removed NODE_AUTH_TOKEN env var from publish / publish-dry-run steps
- Removed always-auth: true from setup-node (no static token to auth with)
- Added 'npm install --global npm@latest' step — Node 22 LTS ships with
  npm 10.9.x and Trusted Publishing needs >= 11.5.1
- Updated README publishing instructions accordingly

The id-token: write permission and --provenance flag stay; together they
let npm exchange the workflow OIDC token for a short-lived publish
credential and attach a sigstore provenance attestation to the artifact.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: nixel2007

.github/workflows/publish.yml

@@ -10,10 +10,10 @@ on:
         type: boolean
         default: false
 
-# Required by `npm publish --provenance`: the workflow exchanges its OIDC
-# token for a sigstore signing identity that npmjs.org records alongside the
-# tarball. Consumers can then verify the artifact came from this specific
-# repo + workflow run via `npm view @1c-syntax/codemirror-lang-bsl provenance`.
+# Required by npm's Trusted Publishing flow: the workflow exchanges its OIDC
+# token for an npm credential at publish time, so no long-lived NPM_TOKEN
+# secret is needed. Together with --provenance this also records a sigstore
+# attestation pointing back at this exact workflow run.
 permissions:
   contents: read
   id-token: write
@@ -35,11 +35,15 @@ jobs:
         with:
           node-version: 22
           cache: npm
+          # Tells npm which registry to ask for an OIDC-bound credential at
+          # publish time. Required even without a token, otherwise the CLI
+          # falls back to whatever a global .npmrc points at.
           registry-url: "https://registry.npmjs.org/"
-          # Forces auth for the public registry even though our committed
-          # .npmrc only sets `registry`. Without this, `npm publish` would
-          # use the anonymous fetch path and reject the upload.
-          always-auth: true
+
+      # Node 22 LTS ships with npm 10.9.x; Trusted Publishing requires
+      # npm >= 11.5.1, so we upgrade in place before any publish step.
+      - name: Upgrade npm for Trusted Publishing support
+        run: npm install --global npm@latest
 
       - run: npm ci
 
@@ -61,11 +65,7 @@ jobs:
       - name: Publish (dry-run)
         if: github.event_name == 'workflow_dispatch' && inputs.dry_run
         run: npm publish --dry-run --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish
         if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && !inputs.dry_run)
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

README.md

@@ -146,41 +146,37 @@ the rollup config copies into `docs/index.html` alongside the bundled
 
 Releases are cut by publishing a GitHub Release with a tag of the form
 `v<version>` (matching `package.json#version`). The
-`.github/workflows/publish.yml` workflow then builds, tests, and runs
-`npm publish --provenance --access public` against npmjs.org.
+`.github/workflows/publish.yml` workflow builds, tests, and runs
+`npm publish --provenance --access public` against npmjs.org. Authentication
+is done via [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers)
+— no long-lived `NPM_TOKEN` secret is needed; npm exchanges the workflow's
+OIDC token for a short-lived credential at publish time.
 
-### First-time setup (NPM_TOKEN)
+### Setup (one-time)
 
-npm does not allow configuring Trusted Publishers for a package that does
-not exist yet, so the first release must be authenticated with an
-[Automation token](https://docs.npmjs.com/about-access-tokens):
+1. <https://www.npmjs.com/package/@1c-syntax/codemirror-lang-bsl/access> →
+   *Trusted Publishers* → *Add*
+2. Provider: **GitHub Actions**
+3. Repository owner: `1c-syntax`, Repository: `codemirror-lang-bsl`
+4. Workflow file name: `publish.yml`
+5. Environment: `npm`
 
-1. Generate an **Automation** access token at
-   <https://www.npmjs.com/settings/USERNAME/tokens> (a user-scope token works;
-   org-scope is fine too if the package lives under an npm org).
-2. Add it as a repository secret named `NPM_TOKEN` at
-   <https://github.com/1c-syntax/codemirror-lang-bsl/settings/secrets/actions>.
-3. Bump `package.json#version`, commit, push, then create a Release at
-   <https://github.com/1c-syntax/codemirror-lang-bsl/releases/new> with tag
-   `v<version>`. The workflow picks up the release-published event and
-   publishes the tarball.
+That's it — no secrets, no tokens. The workflow's `id-token: write`
+permission plus `--provenance` are enough; npm verifies the OIDC token
+against the configured trusted publisher and accepts the upload.
 
-The `workflow_dispatch` trigger has a `dry_run` input that runs
-`npm publish --dry-run` against the same workflow — useful for verifying
-the tarball contents and packaged size before cutting a real release.
+### Cutting a release
 
-### After the first release (Trusted Publishing)
+1. Bump `package.json#version`, commit, push.
+2. <https://github.com/1c-syntax/codemirror-lang-bsl/releases/new> →
+   tag `v<version>` (matching `package.json#version`) → *Publish release*.
+3. The `Publish to npm` workflow picks up the `release.published` event,
+   verifies tag-vs-version, builds, tests, and runs `npm publish`.
 
-Once `@1c-syntax/codemirror-lang-bsl` exists on npmjs.org, switch to
-[Trusted Publishing](https://docs.npmjs.com/trusted-publishers) to drop the
-NPM_TOKEN secret:
+### Dry-run before cutting
 
-1. <https://www.npmjs.com/package/@1c-syntax/codemirror-lang-bsl/access> →
-   *Trusted Publishers* → *Add*
-2. Provider: GitHub Actions; Repository: `1c-syntax/codemirror-lang-bsl`;
-   Workflow file: `.github/workflows/publish.yml`; Environment: `npm`.
-3. Remove the `NPM_TOKEN` secret from the repo (the `NODE_AUTH_TOKEN`
-   env var still gets populated, just from npm's OIDC exchange).
+`workflow_dispatch` on `Publish to npm` accepts a `dry_run` input. Run it
+to validate auth, build, and tarball contents without actually publishing.
 
 ## License