ci: npm publish via OIDC trusted publishing (no token secret) (#21)

Swaps the NPM_TOKEN requirement for npm's Trusted Publisher flow: the
workflow identity (InsForge/insta-cli release.yml) is trusted directly
on npmjs.com. npm upgraded on the runner (OIDC exchange needs ≥11.5).
Skill release section updated in the same PR per its keep-true rule.


Claude-Session: https://claude.ai/code/session_01GMbAe5K1RfwaAcge5inX7P

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: tonychang04

.claude/skills/developing-insta-cli/SKILL.md

@@ -31,10 +31,10 @@ npx tsx src/index.ts --help   # run the CLI from source
 1. **Bump**: PR changing `package.json` version (main is protected — never commit the bump directly). Merge it via the flow above.
 2. **Tag**: `git checkout main && git pull && git tag vX.Y.Z && git push origin vX.Y.Z`.
 3. **Binaries (automatic)**: the `release` workflow builds 5 platform binaries + SHA256SUMS and publishes a GitHub Release. `install.sh`, `agents.sh`, and `insta upgrade` serve users from it immediately.
-4. **npm (automatic on tag IF the `NPM_TOKEN` repo secret is set)**: the `publish-npm` job in
-   `release.yml` publishes with a granular automation token (`--provenance`). If that job fails
-   with "secret is not set", or for an out-of-band publish, the manual fallback — from a clean
-   checkout at the tag, repo root:
+4. **npm (automatic on tag — OIDC trusted publishing)**: the `publish-npm` job authenticates via
+   OpenID Connect (npmjs.com → `insta` → Trusted Publisher = this repo's `release.yml`); no token
+   secret exists. If npm ever rejects the OIDC exchange, or for an out-of-band publish, the manual
+   fallback — from a clean checkout at the tag, repo root:
    ```bash
    npm publish --otp=<2FA code>   # prepublishOnly builds dist/; EOTP error = missing/expired code
    ```
@@ -49,7 +49,7 @@ npx tsx src/index.ts --help   # run the CLI from source
 | John-bot ignored the request | Batched links — resend ONE link per message |
 | `npm error code EOTP` | Publish needs `--otp=<fresh 2FA code>` |
 | `npm publish` ENOENT package.json | Ran outside the repo root |
-| `npx insta@latest` behind the GH release | `publish-npm` job failed/skipped (NPM_TOKEN?) — see step 4 |
+| `npx insta@latest` behind the GH release | `publish-npm` job failed (OIDC trust/config?) — see step 4 |
 | CLI hits the wrong server in tests | Persisted `~/.insta/config.json` apiUrl; set `INSTA_API_URL` (≥0.0.7) or move the config aside |
 
 ## Keep this skill true

.github/workflows/release.yml

@@ -107,16 +107,10 @@ jobs:
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
-      - name: Require NPM_TOKEN
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          if [ -z "$NPM_TOKEN" ]; then
-            echo "::error::NPM_TOKEN repo secret is not set — create a GRANULAR automation token at npmjs.com (Access Tokens → Generate → Granular, packages: insta, permissions: read/write) and add it under Settings → Secrets → Actions."
-            exit 1
-          fi
+      # OIDC trusted publishing: npm trusts this workflow's identity directly (configured on
+      # npmjs.com → package `insta` → Trusted Publisher: InsForge/insta-cli, release.yml).
+      # No token secret. Needs npm ≥ 11.5 for the OIDC exchange; Node 22 bundles an older one.
+      - run: npm install -g npm@latest
       - run: npm ci
-      - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Publish to npm (OIDC)
         run: npm publish --provenance --access public