Switch npm publish to OIDC trusted publishing

Use a custom npm-publish workflow instead of cargo-dist's built-in npm
job to support OIDC trusted publishing with provenance attestations.

This approach survives `dist generate` because:
- Custom workflow is in a separate file cargo-dist doesn't manage
- dist-workspace.toml references it via "./npm-publish"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: sinelaw

.github/workflows/npm-publish.yml

@@ -0,0 +1,39 @@
+# Custom npm publish job with OIDC trusted publishing
+# This replaces the built-in cargo-dist npm job to support provenance attestations
+
+name: npm-publish
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        required: true
+        type: string
+
+jobs:
+  publish-npm:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PLAN: ${{ inputs.plan }}
+    if: ${{ !fromJson(inputs.plan).announcement_is_prerelease || fromJson(inputs.plan).publish_prereleases }}
+    steps:
+      - name: Fetch npm packages
+        uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: npm/
+          merge-multiple: true
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Publish to npm with provenance
+        run: |
+          for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith("-npm-package.tar.gz")] | any)'); do
+            pkg=$(echo "$release" | jq '.artifacts[] | select(endswith("-npm-package.tar.gz"))' --raw-output)
+            npm publish --access public --provenance "./npm/${pkg}"
+          done

.github/workflows/release.yml

@@ -346,45 +346,30 @@ jobs:
           done
           git push
 
-  publish-npm:
+  custom-npm-publish:
     needs:
       - plan
       - host
-    runs-on: "ubuntu-22.04"
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PLAN: ${{ needs.plan.outputs.val }}
     if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
-    steps:
-      - name: Fetch npm packages
-        uses: actions/download-artifact@v4
-        with:
-          pattern: artifacts-*
-          path: npm/
-          merge-multiple: true
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-      - run: |
-          for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith("-npm-package.tar.gz")] | any)'); do
-            pkg=$(echo "$release" | jq '.artifacts[] | select(endswith("-npm-package.tar.gz"))' --raw-output)
-            npm publish --access public --provenance "./npm/${pkg}"
-          done
+    uses: ./.github/workflows/npm-publish.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit
+    # publish jobs get escalated permissions
+    permissions:
+      "id-token": "write"
+      "packages": "write"
 
   announce:
     needs:
       - plan
       - host
       - publish-homebrew-formula
-      - publish-npm
+      - custom-npm-publish
     # use "always() && ..." to allow us to wait for all publish jobs while
     # still allowing individual publish jobs to skip themselves (for prereleases).
     # "host" however must run to completion, no skipping allowed!
-    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') && (needs.publish-npm.result == 'skipped' || needs.publish-npm.result == 'success') }}
+    if: ${{ always() && needs.host.result == 'success' && (needs.publish-homebrew-formula.result == 'skipped' || needs.publish-homebrew-formula.result == 'success') && (needs.custom-npm-publish.result == 'skipped' || needs.custom-npm-publish.result == 'success') }}
     runs-on: "ubuntu-22.04"
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

dist-workspace.toml

@@ -26,6 +26,7 @@ local-artifacts-jobs = ["./musl-builds"]
 # A GitHub repo to push Homebrew formulas to
 tap = "sinelaw/homebrew-fresh"
 # Publish jobs to run in CI
-publish-jobs = ["homebrew", "npm"]
+# Note: Using custom npm-publish job instead of built-in "npm" for OIDC trusted publishing
+publish-jobs = ["homebrew", "./npm-publish"]
 # Post-announce jobs to run in CI
 post-announce-jobs = ["./aur-publish", "./cargo-publish"]