npm trusted publisher

Author: Miskler

.github/workflows/publish.yml

@@ -38,21 +38,21 @@ jobs:
     needs: guard-default-branch
     if: ${{ inputs.target == 'all' || inputs.target == 'lsp' }}
     runs-on: ubuntu-latest
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: "20"
-          cache: npm
-          cache-dependency-path: package-lock.json
-          registry-url: https://registry.npmjs.org
+          node-version: "24.x"
+          package-manager-cache: false
       - name: Install dependencies
         run: npm ci
       - name: Validate the CLI
         run: npm run check
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public
 
   publish-vscode-extension:

README.md

@@ -150,11 +150,11 @@ The workflow reads the package versions from the package metadata already in the
 
 It expects these credentials/configs:
 
-- `NPM_TOKEN` for the npm publish step
+- A npm Trusted Publisher configured for `Open-Inflation/engine-reverse-ide`, workflow `publish.yml`, and the `npm` environment
 - `VSCE_PAT` for the VS Code Marketplace publish step
-- A PyPI Trusted Publisher configured for this repository workflow and the `pypi` environment
+- A PyPI Trusted Publisher configured for `Open-Inflation/engine-reverse-ide`, workflow `publish.yml`, and the `pypi` environment
 
-The PyPI job uses GitHub OIDC through the official `pypa/gh-action-pypi-publish` action, so it does not need an API token secret.
+The npm and PyPI jobs use GitHub OIDC, so they do not need API token secrets.
 
 ## Language overview