From 603d4205ee63255a4378690c3dafdf3ed7bb9c2b Mon Sep 17 00:00:00 2001
From: Ben Papillon <benpapillon@gmail.com>
Date: Sat, 5 Sep 2026 00:21:05 -0700
Subject: [PATCH] chore(ci): publish to npm with trusted publishing

---
 .github/workflows/ci.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51ad33ca..1495830d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -126,6 +126,12 @@ jobs:
     needs: [ compile, test, verify-package ]
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
+    # Trusted Publishing (OIDC), as schematic-js does: no NPM_TOKEN to expire.
+    # This workflow file must be registered as the package's trusted publisher
+    # on npmjs.com (repo SchematicHQ/schematic-node, workflow ci.yml).
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -146,7 +152,6 @@ jobs:
 
       - name: Publish to npm
         run: |
-          npm config set //registry.npmjs.org/:_authToken ${NPM_TOKEN}
           publish() {  # use latest npm to ensure OIDC support
             npx -y npm@latest publish "$@"
           }
@@ -165,5 +170,3 @@ jobs:
               publish --access public
             fi
           fi
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}