[chaliy]

Requested by Михайло · project thread

What changed

Both npm publish lanes (Publish JS for @everruns/bashkit, Publish Web for @everruns/bashkit-wasm) now authenticate with npm trusted publishing over GitHub OIDC instead of the NPM_TOKEN secret.

• Publish jobs keep id-token: write; NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} is gone.
• A new step makes sure npm is >= 11.5.1 (the first release with the OIDC token exchange) and upgrades to a pinned npm@11.6.2 if Node's bundled npm is older.
• setup-node no longer sets registry-url, because it writes an .npmrc with a placeholder auth token. npm defaults to registry.npmjs.org.
• publish_npm.py is unchanged and still passes --provenance. Trusted publishing attaches provenance automatically either way.
• A release-workflow test stops NPM_TOKEN, NODE_AUTH_TOKEN or registry-url from coming back, and checks that each publish job has id-token: write.
• Knowledge (release-process, browser-package) now documents the npmjs.com publisher config.

Why

Publish Web got a 404 on @everruns/bashkit-wasm@0.20.1. The package exists through 0.19.0 and the publish already passes --access public, so npm is hiding an auth failure. Both lanes read the same secret. Trusted publishing removes the long-lived token, so there is nothing to rotate.

Before / After

• Before: the publish step authenticates with secrets.NPM_TOKEN, and the rejected token shows up as an E404 on publish.
• After: npm exchanges the job's OIDC token for a short-lived publish token. Requires a trusted publisher on npmjs.com for each package (Settings > Trusted publisher > GitHub Actions):

Package	Organization	Repository	Workflow filename	Environment
@everruns/bashkit	everruns	bashkit	publish-js.yml	(empty)
@everruns/bashkit-wasm	everruns	bashkit	publish-wasm.yml	(empty)

Local: python3 -m unittest discover -s scripts/tests -p 'test_*.py' passes (184 tests). Against main's workflows the new test fails for both lanes (2 failures).

Risk

• Medium. The real proof is the next publish run. If the trusted publisher isn't configured on npmjs.com, publish still fails with a 404/auth error. Once publishing works, the NPM_TOKEN secret can be deleted.

Checklist

• Tests added or updated
• Backward compatibility considered (CI only)