Publish npm package via trusted publishing (NPM_TOKEN rejected)

.github/workflows/ci.yml

@@ -123,6 +123,9 @@ jobs:
     needs: js-check
     if: startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/js-v')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # npm trusted publishing (OIDC): no stored token, provenance recorded
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -153,13 +156,11 @@ jobs:
       - name: Build
         working-directory: js
         run: pnpm build
-      - name: Publish to npm
+      - name: Publish to npm (trusted publishing)
         working-directory: js
-        # pnpm does not read the NPM_CONFIG_USERCONFIG .npmrc that actions/setup-node
-        # generates, so write the auth token to a project-local .npmrc pnpm will read.
-        # --access public is required for the first publish of the scoped @noctusoft/… package.
+        # npm trusted publishing (GitHub OIDC) replaces the NPM_TOKEN secret: npm is restricting
+        # tokens that bypass 2FA. It needs npm CLI >= 11.5.1, and package.json "repository" must
+        # match this repo. The package has no workspace: dependencies, so npm publishes pnpm's build.
         run: |
-          printf '//registry.npmjs.org/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > .npmrc
-          pnpm publish --no-git-checks --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm install -g npm@latest
+          npm publish --access public

js/package.json

@@ -2,6 +2,11 @@
   "name": "@noctusoft/ezodata-express",
   "version": "1.0.5",
   "description": "Bolt a governed OData v4 + REST + MCP API onto any Express app. Pure TypeScript, full parity with the ez-odata .NET engine.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/YOLOVibeCode/ez-odata-api.git",
+    "directory": "js"
+  },
   "license": "Apache-2.0",
   "author": "Noctusoft, Inc.",
   "type": "module",