From 2ad5a01c9605d6d2bf83308897185aaefd017d74 Mon Sep 17 00:00:00 2001
From: Ricardo Vega <github@noctusoft.com>
Date: Wed, 30 Sep 2026 10:14:08 -0500
Subject: [PATCH] ci: publish npm package via trusted publishing

npm is restricting tokens that bypass 2FA (account changes Aug 2026, direct
publishing Jan 2027); the NPM_TOKEN publish for v1.0.5 was rejected (E404).
Publish with GitHub OIDC instead: id-token permission on the npm job, npm CLI
>= 11.5.1, and a package.json repository field matching this repo (required
for provenance).
---
 .github/workflows/ci.yml | 17 +++++++++--------
 js/package.json          |  5 +++++
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8c8b352..0caf2cf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -123,6 +123,9 @@ jobs:
     needs: js-check
     if: startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/js-v')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # npm trusted publishing (OIDC): no stored token, provenance recorded
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -153,13 +156,11 @@ jobs:
       - name: Build
         working-directory: js
         run: pnpm build
-      - name: Publish to npm
+      - name: Publish to npm (trusted publishing)
         working-directory: js
-        # pnpm does not read the NPM_CONFIG_USERCONFIG .npmrc that actions/setup-node
-        # generates, so write the auth token to a project-local .npmrc pnpm will read.
-        # --access public is required for the first publish of the scoped @noctusoft/… package.
+        # npm trusted publishing (GitHub OIDC) replaces the NPM_TOKEN secret: npm is restricting
+        # tokens that bypass 2FA. It needs npm CLI >= 11.5.1, and package.json "repository" must
+        # match this repo. The package has no workspace: dependencies, so npm publishes pnpm's build.
         run: |
-          printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > .npmrc
-          pnpm publish --no-git-checks --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm install -g npm@latest
+          npm publish --access public
diff --git a/js/package.json b/js/package.json
index c4cc25f..449a91d 100644
--- a/js/package.json
+++ b/js/package.json
@@ -2,6 +2,11 @@
   "name": "@noctusoft/ezodata-express",
   "version": "1.0.5",
   "description": "Bolt a governed OData v4 + REST + MCP API onto any Express app. Pure TypeScript, full parity with the ez-odata .NET engine.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/YOLOVibeCode/ez-odata-api.git",
+    "directory": "js"
+  },
   "license": "Apache-2.0",
   "author": "Noctusoft, Inc.",
   "type": "module",