ci: release workflow — npm Trusted Publishing (OIDC), no token

Wire automated releases via .github/workflows/release.yml: workflow_dispatch (enter the ponder
version) or push tag v<version>. Applies the Portal layer to ponder@<version>, builds, runs the
Portal tests, and publishes @subsquid/ponder@<version>.

Auth uses npm **Trusted Publishing via OIDC** (id-token: write) — no NPM_TOKEN, per npm's move
away from long-lived CI tokens. Guards that the version is declared in versions.json. Repo is
private for now so provenance is off; add --provenance when public. One-time npm trusted-publisher
setup documented in PUBLISHING.md.

Remote updated to subsquid/portal-ponder (org transfer).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dzhelezov

.github/workflows/release.yml

@@ -0,0 +1,56 @@
+name: release
+
+# Publish @subsquid/ponder@<version> = ponder@<version> + the Portal layer.
+# Trigger: manually (Actions → release → Run workflow → enter the ponder version), or push a
+# tag `v<version>` (e.g. v0.16.6). Auth is npm **Trusted Publishing via OIDC** — no NPM_TOKEN.
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "ponder version to publish as @subsquid/ponder@<version> (e.g. 0.16.6). Must have portal/wiring/<version>.patch + a versions.json row."
+        required: true
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: read
+  id-token: write # OIDC token for npm Trusted Publishing (replaces NPM_TOKEN)
+
+concurrency:
+  group: release-${{ github.event.inputs.version || github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: "https://registry.npmjs.org"
+      - run: corepack enable
+      # npm Trusted Publishing (OIDC) requires npm >= 11.5.1; node 22 ships an older npm.
+      - run: npm install -g npm@latest && npm --version
+
+      - name: Resolve version (workflow input or v<version> tag)
+        id: v
+        run: |
+          V="${{ github.event.inputs.version }}"
+          [ -z "$V" ] && V="${GITHUB_REF_NAME#v}"
+          echo "version=$V" >> "$GITHUB_OUTPUT"
+          echo "→ publishing @subsquid/ponder@$V"
+
+      - name: Guard — version must be declared in versions.json
+        run: |
+          node -e "const v='${{ steps.v.outputs.version }}'; const j=require('./versions.json'); if(!j.versions.some(r=>r.ponder===v)){console.error('✗ '+v+' not in versions.json — add a row + portal/wiring/'+v+'.patch first (PUBLISHING.md)');process.exit(1)} console.log('✓ '+v+' declared')"
+
+      - name: Build + test the fork (apply Portal layer to ponder@<version>)
+        run: bash scripts/sync-upstream.sh "${{ steps.v.outputs.version }}" --test
+        env:
+          SYNC_WORKDIR: ${{ runner.temp }}/fork
+
+      - name: Publish to npm (Trusted Publishing via OIDC — no token)
+        working-directory: ${{ runner.temp }}/fork/${{ steps.v.outputs.version }}/packages/core
+        # When this repo is PUBLIC, append `--provenance` for a signed provenance attestation.
+        run: npm publish --access public

PUBLISHING.md

@@ -18,16 +18,33 @@ field per chain that routes the historical backfill through SQD Portal (realtime
   `compat.tested` list the CI matrix proves the seam against. We publish a fork release **only for ponder
   versions a client needs** (the economy), but we *know* which past/future versions hold (the awareness).
 
-## Cut a release for an existing version
+## Releasing — automated (npm Trusted Publishing via OIDC, no token)
+
+Releases run through [`.github/workflows/release.yml`](.github/workflows/release.yml) and
+authenticate to npm with **OIDC Trusted Publishing** — no `NPM_TOKEN` (npm deprecated long-lived
+tokens for CI in favour of the GitHub integration). The job applies the Portal layer to
+`ponder@<version>`, builds, runs the Portal tests, then publishes.
+
+**One-time setup** (a maintainer with publish rights on the `@subsquid` scope):
+
+1. On npmjs.com → `@subsquid/ponder` → *Settings → Trusted Publisher → GitHub Actions*, pointing at
+   repo `subsquid/portal-ponder`, workflow `release.yml`.
+   - *Brand-new package:* if npm requires the package to exist before you can add a trusted publisher,
+     seed it with one manual publish (below), then configure the trusted publisher — every release
+     after that is tokenless.
+2. *(When the repo is public)* add `--provenance` to the publish step for a signed provenance attestation.
+
+**Cut a release:** Actions → **release** → *Run workflow* → enter the ponder version (e.g. `0.16.6`),
+or push a tag `v0.16.6`. The workflow guards that the version is in `versions.json`, builds + tests, and
+publishes `@subsquid/ponder@<version>`. Then flip that row's `status`→`published` in `versions.json`.
+
+**Manual / local** (to seed the first publish, or as a fallback):
 
 ```bash
-scripts/sync-upstream.sh 0.16.6 --test        # clone + apply layer + build + run Portal tests
-cd /tmp/sqd-ponder-fork/0.16.6/packages/core
-npm publish --access public                   # publishes @subsquid/ponder@0.16.6
+scripts/sync-upstream.sh 0.16.6 --test                       # clone + apply layer + build + test
+cd "$SYNC_WORKDIR/0.16.6/packages/core" && npm publish --access public   # uses your local npm login
 ```
 
-Then flip that row's `status`→`published` in `versions.json` and commit.
-
 ## Add a new ponder version
 
 1. **Author the wiring patch.** The seam (`syncBlockRangeData`/`syncBlockData`) is stable, but the 4