@nailuogg/pi-find-packages 0.1.1 → 0.1.2

package/.github/workflows/publish.yml

@@ -6,11 +6,12 @@ on:
 
 permissions:
   contents: write # create the GitHub release
-  id-token: write # reserved for a future Trusted-Publishing (OIDC) switch
+  id-token: write # OIDC token for npm Trusted Publishing
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: npm
     steps:
       - uses: actions/checkout@v4
 
@@ -18,7 +19,9 @@ jobs:
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org/
-          # reads NODE_AUTH_TOKEN from env to write ~/.npmrc
+
+      - name: Ensure npm supports Trusted Publishing
+        run: npm install -g npm@latest # OIDC trusted publishing needs npm >= 11.5.1
 
       - name: Verify version matches tag
         run: |
@@ -29,10 +32,8 @@ jobs:
             exit 1
           fi
 
-      - name: Publish
+      - name: Publish (OIDC trusted publishing, no token)
         run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub release
         run: gh release create "${GITHUB_REF_NAME}" --verify-tag --generate-notes

package/README.md

@@ -58,8 +58,10 @@ The image contains no pi and no credentials: it exists solely to clone/unpack/re
 
 Publishing is automated: push a tag `v<version>` matching `package.json`, and the
 `publish.yml` workflow verifies the version, publishes `@nailuogg/pi-find-packages`
-to npm, and creates a GitHub release. The `NPM_TOKEN` repository secret must hold a
-granular npm access token scoped to the `@nailuogg` packages (npmjs.com → Access Keys).
+to npm, and creates a GitHub release. Publishing uses npm **Trusted Publishing (OIDC)**: the package's npm settings list
+this repository and `publish.yml` as a trusted publisher, so CI authenticates with a
+short-lived OIDC token — no `NPM_TOKEN` secret involved. Requires the workflow to run
+with `id-token: write` (set) and npm >= 11.5.1 (the workflow installs the latest npm).
 
 ## Security boundaries
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nailuogg/pi-find-packages",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Local catalog of the pi package ecosystem with /find-packages: offline search, cold-start data, and sandboxed source analysis for integration review",
   "type": "module",
   "keywords": [