ci: restore secure tokenless npm publishing

[thomson-t]

Background

The release workflow began failing during Node setup after setup-node v7 stopped exporting a placeholder NODE_AUTH_TOKEN. Yarn then attempted to expand the missing token from the generated npm configuration before npm could publish through OIDC.

What Has Changed

• Remove token-style registry configuration and dependency caching from the privileged publish job.
• Scope write and OIDC permissions to the publish job only.
• Pin release workflow actions to immutable commit SHAs and disable checkout credential persistence.
• Use the Node 24 bundled npm version and the runner-provided GitHub CLI.
• Preserve npm provenance and the existing GitHub release contents and target commit.

Screenshots/Video

N/A — no visual changes.

Checklist

• Self-review completed
• Tests added or updated
• Tested locally

[cursor]

PR Summary

Low Risk
Changes are confined to CI release workflow configuration and permissions with no impact on application runtime code.

Overview
Hardens the release publishing workflow by scoping elevated permissions (contents: write and id-token: write) exclusively to the publish job and reducing top-level permissions to contents: read.

Also pins workflow actions (actions/checkout and actions/setup-node) to specific commit SHAs with persist-credentials: false, simplifies Node setup for OIDC npm publishing, and replaces ncipollo/release-action with native GitHub CLI (gh release create).

^{Reviewed by Cursor Bugbot for commit 1779089. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

🟢 Approval recommended

No unresolved review issues were identified.

Pull request overview

Restores secure tokenless npm publishing via OIDC while tightening release workflow security.

Changes:

• Removes token-based registry configuration and dependency caching.
• Scopes write and OIDC permissions to the publish job.
• Pins actions and disables persisted checkout credentials.
• Uses Node 24’s npm and runner-provided GitHub CLI.

File summaries

File	Summary
.github/workflows/release-publish.yml	Implements secure npm publishing and GitHub release creation.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.