feat(npm): trusted publishing

[khaliqgant]

Used https://prpm.dev/packages/prpm/npm-trusted-publishing FWIW

---

Enable npm trusted publishing

Updates the release automation to satisfy npm trusted publishing requirements. Workflow permissions now request contents: write and id-token: write, the job upgrades to the latest npm CLI before publishing, and the release script publishes each workspace package with provenance metadata.

Key Changes

• Added workflow-level contents: write and id-token: write permissions in .github/workflows/publish.yaml
• Installed the latest npm CLI during the publish job so provenance is supported
• Appended the --provenance flag to npm publish calls in scripts/publish.mjs
• Granted id-token: write permission to the publish job in .github/workflows/cli-verification.yaml

Affected Areas

• .github/workflows/publish.yaml
• scripts/publish.mjs
• .github/workflows/cli-verification.yaml

---

This summary was automatically generated by @propel-code-bot

[my-senior-dev-pr-review]

🤖 My Senior Dev

3 files reviewed • 1 high risk • 1 need attention

🚨 High Risk:

• .github/workflows/cli-verification.yaml — Modifies permissions to allow id-token writing, creating potential risks without proper handling of authentication and token management.

⚠️ Needs Attention:

• .github/workflows/cli-verification.yaml — The change lacks documentation on the purpose of the updated permissions, which is important for understanding the security implications of the modification.

View full analysis →

---

💬 Try: @my-senior-dev explain this change or summon @chaos-monkey 🐵 @security-auditor 🔒 @optimizer ⚡ for different perspectives

📖 All commands & personas

You can interact with me by mentioning @my-senior-dev in any comment:

In PR comments or on any line of code:

• Ask questions about the code or PR
• Request explanations of specific changes
• Get suggestions for improvements

Slash commands:

• /help — Show all available commands
• /archeology — See the history and evolution of changed files
• /profile — Performance analysis and suggestions
• /expertise — Find who knows this code best
• /personas — List all available AI personas

AI Personas (mention to get their perspective):

Persona	Focus
@chaos-monkey 🐵	Edge cases & failure scenarios
@skeptic 🤨	Challenge assumptions
@optimizer ⚡	Performance & efficiency
@security-auditor 🔒	Security vulnerabilities
@accessibility-advocate ♿	Inclusive design
@junior-dev 🌱	Simple explanations
@tech-debt-collector 💳	Code quality & shortcuts
@ux-champion 🎨	User experience
@devops-engineer 🚀	Deployment & scaling
@documentation-nazi 📚	Documentation gaps
@legacy-whisperer 🏛️	Working with existing code
@test-driven-purist ✅	Testing & TDD

For the best experience, view this PR on myseniordev.com — includes AI chat, file annotations, and interactive reviews.