ci(release): adopt npm OIDC trusted publishing (#658)

Signed-off-by: 0xisk <0xisk@proton.me>
Co-authored-by: Sai Tirumerla <57160285+tirumerla@users.noreply.github.com>

Author: 0xisk

.github/workflows/release.yml

@@ -1,3 +1,7 @@
+# Publishes to npm via OIDC trusted publishing — no NPM_TOKEN.
+# Prerequisite: this repo + this workflow must be registered as a Trusted
+# Publisher for the package on npmjs.org (package → Settings → Trusted
+# Publishers), otherwise the publish step fails with an auth error.
 name: Publish Package on Release
 
 on:
@@ -13,6 +17,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      attestations: write # Write SLSA build provenance to the attestation store
 
     steps:
       - name: Harden Runner
@@ -23,15 +28,22 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          # No git writes here (publish goes through the npm token), so don't persist creds.
+          # No git writes here (publish uses npm OIDC, not git creds), so don't persist creds.
           persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: ".nvmrc"
+          registry-url: https://registry.npmjs.org
           package-manager-cache: false # Prevent cache poisoning issues
 
+      - name: Ensure npm supports trusted publishing
+        # OIDC trusted publishing requires npm >= 11.5.1. The .nvmrc Node may
+        # bundle an older npm, so pin the floor explicitly: stays on the
+        # vetted 11.x major, avoids a surprise npm major in a release run.
+        run: npm install -g npm@^11.5.1
+
       - name: Enable Corepack
         run: corepack enable
 
@@ -56,11 +68,6 @@ jobs:
           fi
           echo "✅ Version consistency validated: $RELEASE_VERSION"
 
-      - name: Setup npm registry
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          registry-url: "https://registry.npmjs.org"
-
       - name: Pack tarball
         id: pack
         run: |
@@ -100,14 +107,21 @@ jobs:
             exit 1
           fi
 
+      - name: Attest build provenance
+        # Signed SLSA v1 provenance over the exact tarball, stored in the
+        # GitHub attestation store (verifiable with `gh attestation verify`).
+        # Complements the npm-registry provenance from NPM_CONFIG_PROVENANCE.
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: ${{ steps.pack.outputs.tarball }}
+
       - name: Publish to npm
         run: |
           # Publish the tarball with appropriate tag
           npm publish "${{ steps.pack.outputs.tarball }}" --tag "${{ steps.pack.outputs.tag }}" --access public
         env:
+          # No NODE_AUTH_TOKEN — OIDC trusted publishing mints per-run credentials.
           NPM_CONFIG_PROVENANCE: true
-          # Token required for actions/setup-node
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Log success
         run: |