Token-free CI: public-npm deps, OIDC, built-in GITHUB_TOKEN, pnpm 11

[rosskevin]

Summary

Completes the move to a fully token-free release pipeline and bumps to pnpm 11. Follows up on #34 (which fixed npm publishing via OIDC) by removing the last long-lived token — the GH_TOKEN PAT auto used for GitHub releases, which was the cause of the v4.0.0 release 404.

Why

The v4.0.0 release published to npm (OIDC ✓) but failed to create the GitHub Release: auto's Releases API call used GH_TOKEN (a fine-grained PAT that could read packages but lacked Contents: write), returning 404. Rather than rotate another PAT, this removes the PAT entirely.

Changes

Token-free releases

• Drop GitHub Packages routing — remove .npmrc. @alienfast/biome-config and @alienfast/tsconfig are now consumed from public npm, so dependency installs need no token at all. (Requires biome-config ≥ 1.0.5 on public npm, now published as 1.0.6.)
• auto uses the built-in GITHUB_TOKEN for GitHub releases/labels (it already has contents/issues/pull-requests: write from the workflow permissions block). Removed the GH_TOKEN PAT, PROTECTED_BRANCH_REVIEWER_TOKEN, and the now-unused NPM_TOKEN envs from build.yml.
• npm publish stays on OIDC trusted publishing (from Migrate tooling to pnpm, Biome, and tsdown #34) — no NPM_TOKEN.

Net: no long-lived secrets in the release path — installs use public npm, GitHub releases use the per-run built-in token, npm publish uses OIDC.

pnpm 10 → 11

• packageManager: pnpm@11.5.1.
• pnpm 11 no longer reads the package.json pnpm field, so build-script approval moves to pnpm-workspace.yaml as allowBuilds (the pnpm 11 mechanism; onlyBuiltDependencies alone is no longer honored).
• minimumReleaseAge is a pnpm 11 default (won't install <24h-old packages — a supply-chain delay enforced on every pnpm install, including CI). Freshly-published @alienfast/* releases (our own org) would block CI, so pnpm-workspace.yaml allowlists the scope via minimumReleaseAgeExclude: ['@alienfast/*']. Third-party deps keep the age protection.
• Regenerated pnpm-lock.yaml (pnpm 11 format; @alienfast/* resolve from public npm).

Dependency bumps

• @alienfast/biome-config ^1.0.6, @biomejs/biome ^2.4.16.
• i18next pinned to 26.3.0 (exact). 26.3.1 was published <24h ago and trips the minimumReleaseAge policy above; since i18next is third-party (not covered by the @alienfast/* allowlist) it's pinned to the prior, functionally-equivalent release and can be bumped once 26.3.1 ages out.

Testing

• ✅ pnpm install --frozen-lockfile — passes pnpm 11's supply-chain policy check (the exact CI command), token-free (public npm), esbuild/biome build scripts approved via allowBuilds
• ✅ pnpm build — ESM + DTS (4 files)
• ✅ pnpm check-types
• ✅ pnpm test — 18 passed
• ✅ pnpm check-biome — no findings
• ✅ no npm.pkg.github.com references remain (config or lockfile)

Note

The v4.0.0 GitHub Release is still missing (the failed run). Once this merges, future releases will create it correctly; the existing v4.0.0 can be backfilled separately from the existing tag if desired.

---

🤖 Generated with Claude Code

[github-actions]

📦 Published PR as canary version: 4.0.1--canary.35.26899931270.0

✨ Test out this PR locally via:

npm install vite-plugin-i18next-loader@4.0.1--canary.35.26899931270.0
# or 
yarn add vite-plugin-i18next-loader@4.0.1--canary.35.26899931270.0

[github-actions]

🚀 PR was released in v4.0.1 🚀