Fix npm publish workflow EOTP failures by preferring GitHub trusted publishing

.github/workflows/npm-publish.yml

@@ -1,6 +1,6 @@
 # Publishes @mitii/v8 → @mitii/sdk → @mitii/host → @mitii/cli to npm.
 # Invoked from the Release workflow on v* tags, or manually via workflow_dispatch.
-# Requires repository secret: NPM_TOKEN
+# Prefers GitHub OIDC trusted publishing; NPM_TOKEN is optional fallback.
 name: npm publish
 
 on:
@@ -21,12 +21,12 @@ jobs:
           node-version: 20
           registry-url: https://registry.npmjs.org
           cache: pnpm
-      - name: Require NPM_TOKEN
+      - name: Require publish auth
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          if [ -z "$NPM_TOKEN" ]; then
-            echo "::error::NPM_TOKEN secret is missing. Add an npm automation token in repo Settings → Secrets → Actions."
+          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] && [ -z "$NPM_TOKEN" ]; then
+            echo "::error::No publish auth configured. Enable npm trusted publishing for this repo (recommended) or set NPM_TOKEN."
             exit 1
           fi
       - name: Install native build tools

docs/RELEASE.md

@@ -51,7 +51,7 @@ Add these under **Settings → Secrets and variables → Actions** (values are n
 
 | Secret | Required | Purpose |
 |---|---|---|
-| `NPM_TOKEN` | Yes (npm job) | npm automation token with publish rights for `@mitii/*` |
+| `NPM_TOKEN` | Optional fallback | npm automation token with publish rights for `@mitii/*` when trusted publishing is not configured |
 | `VSCE_PAT` | Yes (marketplace job) | Azure DevOps PAT with Marketplace publish scope for publisher `mitii` |
 | `OVSX_PAT` | Optional | Open VSX token; Open VSX publish is skipped when unset |
 
@@ -66,7 +66,7 @@ Add these under **Settings → Secrets and variables → Actions** (values are n
    - Attach them to a GitHub Release
    - Publish all four targets to the VS Code Marketplace (`VSCE_PAT`)
    - Publish to Open VSX when `OVSX_PAT` is set
-   - Call **npm publish** for `@mitii/v8` → `@mitii/sdk` → `@mitii/host` → `@mitii/cli` (`NPM_TOKEN`)
+   - Call **npm publish** for `@mitii/v8` → `@mitii/sdk` → `@mitii/host` → `@mitii/cli` (GitHub OIDC trusted publishing, with `NPM_TOKEN` fallback)
 
 ### Local / manual
 

scripts/publish-npm.cjs

@@ -1,10 +1,16 @@
 const { spawnSync } = require('node:child_process');
 
 const packages = ['@mitii/v8', '@mitii/sdk', '@mitii/host', '@mitii/cli'];
+const hasToken = Boolean(process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN);
+const hasGithubOidc = Boolean(
+  process.env.GITHUB_ACTIONS &&
+    process.env.ACTIONS_ID_TOKEN_REQUEST_URL &&
+    process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,
+);
 
-if (!process.env.NODE_AUTH_TOKEN && !process.env.NPM_TOKEN) {
+if (!hasGithubOidc && !hasToken) {
   console.error(
-    'Missing npm auth token. Set NODE_AUTH_TOKEN (or NPM_TOKEN) before publishing.',
+    'Missing npm auth. Configure GitHub OIDC trusted publishing or set NODE_AUTH_TOKEN (or NPM_TOKEN).',
   );
   process.exit(1);
 }
@@ -13,17 +19,35 @@ if (!process.env.NODE_AUTH_TOKEN && process.env.NPM_TOKEN) {
   process.env.NODE_AUTH_TOKEN = process.env.NPM_TOKEN;
 }
 
+function publishWithPnpm(name, args, env = process.env) {
+  return spawnSync('pnpm', ['--filter', name, 'publish', ...args], {
+    stdio: 'inherit',
+    shell: process.platform === 'win32',
+    env,
+  });
+}
+
 for (const name of packages) {
   console.log(`Publishing ${name}…`);
-  const result = spawnSync(
-    'pnpm',
-    ['--filter', name, 'publish', '--access', 'public', '--no-git-checks'],
-    {
-      stdio: 'inherit',
-      shell: process.platform === 'win32',
-      env: process.env,
-    },
-  );
+  let result;
+  if (hasGithubOidc) {
+    const trustedEnv = { ...process.env };
+    delete trustedEnv.NODE_AUTH_TOKEN;
+    delete trustedEnv.NPM_TOKEN;
+    result = publishWithPnpm(
+      name,
+      ['--access', 'public', '--no-git-checks', '--provenance'],
+      trustedEnv,
+    );
+    if ((result.status ?? 1) !== 0 && hasToken) {
+      console.warn(
+        `Trusted publishing failed for ${name}; retrying with npm token authentication.`,
+      );
+      result = publishWithPnpm(name, ['--access', 'public', '--no-git-checks']);
+    }
+  } else {
+    result = publishWithPnpm(name, ['--access', 'public', '--no-git-checks']);
+  }
   if ((result.status ?? 1) !== 0) {
     console.error(`Failed to publish ${name}`);
     process.exit(result.status ?? 1);