From 483ae3bfc1c74558a89da39046a412ca828b23a8 Mon Sep 17 00:00:00 2001
From: Hugo Bjork <hugo@berget.ai>
Date: Mon, 7 Sep 2026 17:23:31 +0200
Subject: [PATCH] ci(publish): switch to npm OIDC trusted publishing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The package has a Trusted Publisher configured on npmjs.com
(berget-ai/cli / publish.yml), but the workflow still authenticated with
the classic NPM_TOKEN — which has since expired, making npm publish fail
with a misleading 404. Trusted publishing needs id-token: write and
npm >= 11.5.1; no token secret required.
---
 .github/workflows/publish.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e4fe665..294f4e4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -41,6 +41,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # OIDC trusted publishing (npmjs.com → berget → Trusted Publisher:
+      # berget-ai/cli / publish.yml). No NPM_TOKEN needed — the old classic
+      # token expired, which made npm publish fail with a misleading 404.
+      id-token: write
     steps:
       # The repo ruleset requires PRs for GITHUB_TOKEN pushes to main.
       # Checking out with the repo Deploy Key (SSH) makes the version-bump
@@ -72,7 +76,7 @@ jobs:
           npm version ${{ inputs.bump }} -m "release: %s"
           git push --follow-tags
 
-      - name: Publish to NPM
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Publish to NPM (OIDC trusted publishing)
+        run: |
+          npm install -g npm@latest   # OIDC trusted publishing needs npm >= 11.5.1
+          npm publish