ci: publish to npm via Trusted Publishing (OIDC), drop NPM_TOKEN

release-please.yml published with a long-lived NODE_AUTH_TOKEN/NPM_TOKEN that
kept failing (claudius-chat-widget stuck at 1.6.0; create-claudius never
published). Switch the automatic release publish to npm Trusted Publishing
(OIDC): remove NODE_AUTH_TOKEN, upgrade to npm >= 11.5.1, bump publish Node to
22, and rely on the existing id-token: write permission. Each package needs a
trusted publisher (repo + release-please.yml) configured at npmjs.com.

Also correct publish-npm.yml's comment: OIDC cannot do a new package's first
publish (npm requires the package to exist before a trusted publisher can be
configured), and only one trusted publisher is allowed per package.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: PAMulligan

.github/workflows/publish-npm.yml

@@ -1,18 +1,19 @@
 name: Publish to npm
 
-# Manual, on-demand publish of a package to npm.
+# Manual, on-demand publish of a package to npm, to recover from a failed
+# release publish without waiting for the next release. (release-please.yml
+# publishes automatically when it cuts a release.)
 #
-# The release-please workflow already publishes automatically when it cuts a
-# release. This workflow exists for the cases that one can't handle:
-#   - bootstrapping the very first publish of a package (the release for the
-#     current version already exists, so re-running release-please is a no-op), and
-#   - recovering from a failed release publish without waiting for the next release.
+# Auth uses npm Trusted Publishing (OIDC) — there is no NPM_TOKEN secret.
+# Requires id-token: write and npm >= 11.5.1, so we upgrade the runner's
+# bundled npm before publishing. Provenance is generated automatically.
 #
-# Auth uses npm Trusted Publishing (OIDC) — there is no NPM_TOKEN secret. A
-# trusted publisher matching this repo + workflow filename must be configured
-# on each package at npmjs.com. Requires id-token: write and npm >= 11.5.1, so
-# we upgrade the runner's bundled npm before publishing. Provenance is
-# generated automatically.
+# NOTE: npm allows only ONE trusted publisher per package, configured here for
+# release-please.yml. To publish from THIS workflow instead, temporarily
+# repoint the package's trusted publisher (npmjs.com -> package Settings) to
+# publish-npm.yml, dispatch, then switch it back. A brand-new package's FIRST
+# publish cannot use OIDC at all — publish it once with a token (locally), then
+# configure trusted publishing.
 on:
   workflow_dispatch:
     inputs:
@@ -56,7 +57,7 @@ jobs:
       # long as a matching trusted publisher is configured for this package.
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           registry-url: https://registry.npmjs.org
           cache: pnpm
           cache-dependency-path: ${{ inputs.package }}/pnpm-lock.yaml

.github/workflows/release-please.yml

@@ -76,9 +76,14 @@ jobs:
           gh release upload "${{ steps.release.outputs.tag_name }}" \
             cdn/claudius.iife.js cdn/claudius.css --clobber
 
-      # On merge, publish the widget to npm. Runs against the default checkout
-      # (main at the released commit), which carries the version release-please
-      # just bumped. --provenance signs the package via the id-token permission.
+      # On merge, publish to npm via Trusted Publishing (OIDC) — no long-lived
+      # NPM_TOKEN. Each package has a trusted publisher configured at npmjs.com
+      # matching this repo + this workflow filename (release-please.yml); the
+      # id-token: write permission above lets npm mint a short-lived token.
+      # Trusted Publishing needs npm >= 11.5.1 (newer than Node's bundled npm),
+      # so we upgrade npm first. Provenance is generated automatically. Runs
+      # against the default checkout (main at the released commit), which carries
+      # the version release-please just bumped.
       - name: Setup pnpm (npm publish)
         if: ${{ steps.release.outputs.release_created }}
         uses: pnpm/action-setup@v4
@@ -89,16 +94,18 @@ jobs:
         if: ${{ steps.release.outputs.release_created }}
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           registry-url: https://registry.npmjs.org
           cache: pnpm
           cache-dependency-path: widget/pnpm-lock.yaml
 
+      - name: Upgrade npm for trusted publishing
+        if: ${{ steps.release.outputs.release_created }}
+        run: npm install -g npm@latest
+
       - name: Build and publish widget
         if: ${{ steps.release.outputs.release_created }}
         working-directory: widget
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           pnpm install --frozen-lockfile
           pnpm build
@@ -107,8 +114,6 @@ jobs:
       - name: Build and publish create-claudius
         if: ${{ steps.release.outputs.release_created }}
         working-directory: create-claudius
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           pnpm install --frozen-lockfile
           pnpm build