Please verify the following:

• yarn build-and-test:local passes
• I have added tests for any new features, if relevant
• README.md (or relevant documentation) has been updated with your changes

Describe your PR

Migrates the reactotron CI publish pipeline from classic NPM_TOKEN auth to npm Trusted Publishing via CircleCI OIDC. npm GA'd CircleCI support on 2026-04-06; this PR wires us up.

The pipeline has been broken since npm revoked classic tokens on 2025-12-09 and #1602 left the renamed reactotron-npm-context with an empty NPM_TOKEN. Rather than mint a granular replacement (capped at 90 days) and rotate forever, OIDC eliminates the human-managed token entirely.

Changes

• .circleci/config.yml (release_package job) — replaces the npm whoami + ~/.npmrc token write with a "Mint npm OIDC token" step using circleci run oidc get --claims '{"aud":"npm:registry.npmjs.org"}'.
• scripts/release.artifacts.mjs — accepts either NPM_TOKEN or NPM_ID_TOKEN, and performs the npm OIDC token exchange directly (POST /-/npm/v1/oidc/token/exchange/package/<ident>). This in-script exchange is a workaround for yarnpkg/berry#7122: Yarn 4.14.1's getOidcToken helper handles CircleCI, but the allowOidc gate in publish.ts only flips on for GITHUB_ACTIONS / GITLAB_CI. Once 7122 lands and we bump Yarn, the script-level exchange block can be deleted.
• Yarn 4.1.1 → 4.14.1 (4.14 brought the CircleCI OIDC support that 7122 finishes wiring up).
• .yarnrc.yml — keeps npmAuthToken: "${NPM_TOKEN-}" as a soft fallback during cutover. Empty string is falsy in Yarn's auth chain, so it's a no-op when OIDC is in play. Removed in a follow-up PR after first prod publish.
• docs/contributing/releasing.md — new "OIDC publish flow" section covering the CI flow, how to add a trusted publisher when shipping a new package, and the upstream Yarn workaround.

Pilot validation

Pilot package: eslint-plugin-reactotron@0.1.10-beta.0. Pushed tag from branch test/oidc-pilot-eslint, published under the beta dist-tag (semver prerelease — invisible to ^/~/* ranges). Pipeline succeeded; package published.

The npm registry metadata for the pilot version records:

"_npmUser": {
  "name": "CircleCI",
  "email": "npm-oidc-no-reply@github.com",
  "trustedPublisher": {
    "id": "circleci",
    "oidcConfigId": "oidc:71dbce82-a25e-4b17-a0e3-78908cc0e805"
  }
}

This is the smoking-gun proof the publish ran via the trusted publisher path, not legacy token auth. _npmVersion: null and _nodeVersion: null (set when the publisher is OIDC) corroborate.

• npm: https://www.npmjs.com/package/eslint-plugin-reactotron/v/0.1.10-beta.0
• GitHub release: https://github.com/infinitered/reactotron/releases/tag/eslint-plugin-reactotron%400.1.10-beta.0
• CircleCI pipeline: https://app.circleci.com/pipelines/gh/infinitered/reactotron/2762

Pre-merge prerequisites

• ✅ Trusted publisher configured on all 11 npm packages (same Org / Project / Pipeline Definition / Context / VCS Origin tuple, validated by the pilot's successful publish).
• ✅ "Publishing access" tightened to "Require two-factor authentication and disallow tokens (recommended)" on all 11 packages. Per npm's inline note, this is fully OIDC-compatible — short-lived OIDC publish tokens are a separate auth path.

Out of scope: reactotron-app (Electron app, GitHub release artifacts only), reactotron-mcp ("private": true).

Follow-up PRs

After first successful production OIDC publish:

• Remove npmAuthToken: "${NPM_TOKEN-}" from .yarnrc.yml.
• Tighten release.artifacts.mjs to require only NPM_ID_TOKEN.
• Clear NPM_TOKEN from CircleCI context (currently absent; belt-and-suspenders).

After yarnpkg/berry#7122 lands and we bump Yarn:

• Delete the OIDC exchange block in scripts/release.artifacts.mjs — Yarn handles the exchange directly via yarn npm publish.
• Simplify the OIDC docs section.

Notes

• The chore commit only touches infra files (.circleci/, .yarnrc.yml, root package.json, yarn.lock, scripts/release.artifacts.mjs, docs/, .yarn/releases/). No lib/* or apps/* workspaces affected → 0 release tags created on merge → no auto-publish triggered. First real OIDC publish happens on the next legitimate code change inside a lib/* workspace.

🤖 Generated with Claude Code