[mvantellingen]

npm trusted publishing

The org-level NPM_TOKEN secret is gone, so releases now publish through npm trusted publishing (OIDC), following labd/commercetools-node-mock.

• release job: environment: release, with id-token: write, contents: write and pull-requests: write
• Drops NPM_TOKEN; upgrades npm to ^11.6.4 (trusted publishing needs npm >= 11.5.1; pnpm 9 publishes through the npm CLI)
• changesets/action v1.7.0 -> v2.1.2 (inputs renamed), with push-with-git-cli: true and NPM_CONFIG_PROVENANCE: true
• package.json: adds the missing repository (git+https://github.com/labd/node-enviconf.git), which provenance checks need, and sets publishConfig.provenance: true

Not changed: the release job keeps labd/gh-actions-typescript/pnpm-install@v1.0.0, which always caches the pnpm store. Switching to cache: false needs v1.1.0, which is too new for the 7-day pinact min-age.

Before merging, add a trusted publisher on npmjs.com for @labdigital/enviconf. Use repository labd/node-enviconf, workflow release.yml and environment release.

pnpm 12

• packageManager → pnpm@12.12.0 (from 9.15.3; pnpm 12 applies minimumReleaseAge to its own version, 12.12.0 is the newest 12.x older than 14 days)
• New pnpm-workspace.yaml with minimumReleaseAge: 20160 (14 days). pnpm 12 also checks the existing lockfile against that policy, so currently locked versions younger than 14 days (vitest 5.0.5 + @vitest/*, rolldown 1.2.15 bindings, @oxc-project/types 0.155.0, postcss 8.5.31) are listed as exact name@version entries in minimumReleaseAgeExclude; they can be dropped after 2026-11-04.
• allowBuilds: esbuild: false (its postinstall was already skipped before)
• pnpm-lock.yaml: only adds pnpm's own packageManagerDependencies document, no dependency versions changed
• labd/gh-actions-typescript/pnpm-install → v1.1.0 (pnpm from packageManager), cache: false in the release job

[changeset-bot]

⚠️ No Changeset found

Latest commit: cffe35e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR