Publish to npm via trusted publishing instead of NPM_TOKEN

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
 
       - run: npm ci
 

.github/workflows/release.yml

@@ -1,7 +1,8 @@
 name: Release
 
 # Publishes to npm when a GitHub Release is published.
-# See RELEASING.md for the full process and required NPM_TOKEN secret.
+# Authenticates to npm as a trusted publisher via OIDC (no token needed).
+# See RELEASING.md for the full process.
 on:
   release:
     types: [published]
@@ -18,8 +19,11 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
-          registry-url: 'https://registry.npmjs.org'
+          node-version: 24
+
+      # Trusted publishing via OIDC requires npm >= 11.5.1; pin to latest to be safe.
+      - name: Upgrade npm
+        run: npm install -g npm@latest
 
       - run: npm ci
 
@@ -42,5 +46,3 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

RELEASING.md

@@ -47,17 +47,26 @@ Publishing the release triggers `.github/workflows/release.yml`, which:
 - runs `npm audit` (advisory — does not block the release),
 - publishes to npm with [provenance](https://docs.npmjs.com/generating-provenance-statements).
 
-## One-time setup: the `NPM_TOKEN` secret
-
-Publishing needs an npm access token stored as a repository secret named
-`NPM_TOKEN`:
-
-1. On [npmjs.com](https://www.npmjs.com/) → **Access Tokens** → **Generate New
-   Token** → **Granular Access Token** (recommended) with **Read and write**
-   permission scoped to the `altis-cli` package. Use an **Automation** token so
-   it bypasses 2FA in CI.
-2. In GitHub: **Settings → Secrets and variables → Actions → New repository
-   secret**, name it `NPM_TOKEN`, and paste the token.
+## One-time setup: trusted publishing
+
+Publishing authenticates to npm as a
+[trusted publisher](https://docs.npmjs.com/trusted-publishers) via OIDC — no
+token or repository secret is required.
+
+A package admin configures this once on npmjs.com. If the config is ever lost,
+or you set this up for another package, these are the fields — npm matches them
+exactly and they are **case-sensitive**:
+
+1. Go to the [`altis-cli` package](https://www.npmjs.com/package/altis-cli) →
+   **Settings** → **Trusted publisher** → **GitHub Actions**.
+2. Organization or user: `humanmade`
+3. Repository: `altis-cli`
+4. Workflow filename: `release.yml` (exactly, including the `.yml`)
+5. Environment: **leave blank** — this repo has no GitHub environments
+   configured, so anything entered here will cause the publish to fail.
+
+The workflow grants `id-token: write` (for the OIDC exchange) and upgrades npm
+to a version new enough to support trusted publishing (npm 11.5.1+).
 
 Provenance additionally requires the repository to be public and the
 `repository` field in `package.json` to be set (both already true).