ci(release): switch npm publish to provenance-based auth

[BlackHole1]

Add explicit permissions for OIDC token and contents access. Remove NODE_AUTH_TOKEN in favor of npm provenance publishing, which provides stronger supply chain security guarantees.

[coderabbitai]

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow configuration to enhance authentication and permissions handling in the release process.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Walkthrough

This change modifies the GitHub Actions release workflow configuration file. A permissions block is added to the workflow, granting explicit access to id-token and contents write permissions. Simultaneously, the NODE_AUTH_TOKEN environment variable is removed from the Publish step. These are configuration-level adjustments to the CI/CD pipeline setup.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Pre-merge checks

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The pull request title follows the required format (): with 'ci' type and 'release' scope, accurately describing the main change to switch npm publish authentication method.
Description check	✅ Passed	The pull request description is directly related to the changeset, explaining both the additions (permissions for OIDC and contents access) and removal (NODE_AUTH_TOKEN) with clear rationale about supply chain security.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR modernizes the npm publishing workflow by switching from token-based authentication to provenance-based publishing, which provides enhanced supply chain security through cryptographic attestation of package origin.

Key Changes:

• Added OIDC token and contents write permissions to enable provenance publishing
• Removed NODE_AUTH_TOKEN environment variable from the publish step

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The publish command is missing the --provenance flag, which is required for npm provenance publishing. Without this flag, the id-token permissions and removal of NODE_AUTH_TOKEN will cause the publish step to fail due to authentication errors. Add --provenance to the pnpm publish command to enable provenance-based authentication.

Suggested change

	pnpm publish --access public --no-git-checks
	pnpm publish --provenance --access public --no-git-checks

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

.github/workflows/release.yml (2)

1-1: Fix typo in workflow name.

The workflow name has a typo: "Rlease" should be "Release". This appears in the GitHub Actions UI.

🔎 Proposed fix

-name: Rlease
+name: Release

---

51-53: Add --provenance flag to enable npm provenance attestations.

The pnpm publish command is missing the --provenance flag required to generate npm provenance attestations. pnpm v8.4.0+ supports this flag, and it is necessary for provenance-based publishing to function with the OIDC token configured in this workflow.

Proposed fix

      - name: Publish
        run: |
-          pnpm publish --access public --no-git-checks
+          pnpm publish --access public --no-git-checks --provenance

🧹 Nitpick comments (1)

.github/workflows/release.yml (1)

15-16: Consider updating to v4 of GitHub Actions.

Both actions/checkout and actions/setup-node have v4 versions available with improvements and security updates.

🔎 Proposed updates

       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 18
           registry-url: 'https://registry.npmjs.org'

Also applies to: 18-19

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 6a91a94 and be37ddb.

📒 Files selected for processing (1)

• .github/workflows/release.yml

🔇 Additional comments (1)

.github/workflows/release.yml (1)

7-9: LGTM! Permissions correctly configured for provenance-based publishing.

The id-token: write permission enables OIDC token generation for npm provenance, and contents: write allows the workflow to create GitHub releases.