ci: migrate npm release to OIDC trusted publishing with provenance

.github/workflows/release.yaml

@@ -6,7 +6,9 @@ on:
     types: [released]
 
 permissions:
-  contents: read    
+  contents: read
+  # Required for npm trusted publishing (OIDC) and provenance attestations
+  id-token: write
 
 env:
   HYPHEN_PUBLIC_API_KEY: ${{ secrets.HYPHEN_PUBLIC_API_KEY }}
@@ -31,20 +33,23 @@ jobs:
       with:
         node-version: 22
         cache: 'pnpm'
+        registry-url: 'https://registry.npmjs.org'
 
     - name: Install Dependencies
       run: pnpm install
 
-    - name: Build    
+    - name: Build
       run: pnpm build
 
-    - name: Testing    
+    - name: Testing
       run: pnpm test
 
-    - name: Publish
-      run: |
-        npm config set //registry.npmjs.org/:_authToken ${NPM_TOKEN}
-        npm publish --ignore-scripts
-      env:
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    # Trusted publishing (OIDC) requires npm CLI >= 11.5.1, which is newer than
+    # the version bundled with Node.js 22.
+    - name: Update npm
+      run: npm install -g npm@latest
 
+    - name: Publish
+      # No NPM_TOKEN: authentication is handled via OIDC trusted publishing.
+      # Provenance attestations are generated from the OIDC identity.
+      run: npm publish --provenance --ignore-scripts

package.json

@@ -2,6 +2,14 @@
   "name": "@hyphen/sdk",
   "version": "3.1.0",
   "description": "Hyphen SDK for Node.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Hyphen/nodejs-sdk.git"
+  },
+  "homepage": "https://github.com/Hyphen/nodejs-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/Hyphen/nodejs-sdk/issues"
+  },
   "type": "module",
   "packageManager": "pnpm@11.6.0",
   "main": "dist/index.cjs",