ci: use npm trusted publishing

.github/workflows/release.yml

@@ -29,19 +29,15 @@ jobs:
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
-      - name: Verify intentional release and token
+      - name: Verify release version and tag
         env:
           RELEASE_VERSION: ${{ inputs.version }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           node --input-type=module -e '
           import fs from "node:fs";
           const version = JSON.parse(fs.readFileSync("package.json", "utf8")).version;
-          if (!process.env.NODE_AUTH_TOKEN) throw new Error("NPM_TOKEN is required");
           if (version !== process.env.RELEASE_VERSION || process.env.GITHUB_REF !== "refs/tags/v" + version) throw new Error("Version and tag must match");'
       - run: npm ci --ignore-scripts
       - run: npm run check
       - run: npm pack --dry-run
-      - run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm publish --access public

docs/releasing.md

@@ -1,13 +1,19 @@
 # Releasing
 
-The npm package name is a target until a maintainer verifies ownership and publishes it. Do not claim that `npx reproshot` installs this repository before that step.
+ReproShot publishes from GitHub Actions through npm Trusted Publishing. The trusted publisher is restricted to:
 
-1. Confirm ownership of the npm package name `reproshot`. If unavailable, choose an available scoped package and update installation documentation before releasing.
-2. Run `npm ci --ignore-scripts`, `npm run check`, `npm run demo` and `npm pack --dry-run`. Review all generated evidence. Wait for the full OS/Node CI matrix to pass on the release commit.
-3. Update `package.json`, `package-lock.json` and `src/types.ts` together. Record user-visible changes in `CHANGELOG.md`.
-4. Commit the release, create a matching `v<version>` tag and push it. A tag alone cannot publish.
-5. Create the GitHub environment `npm`; configure required reviewers where available. Add an appropriately scoped npm automation token as `NPM_TOKEN`. Never commit it.
-6. Run **Publish npm release** manually on the version tag. Enter the exact version and `publish-reproshot`. The workflow requires the token, checks the tag and package version, runs checks, and publishes with provenance.
-7. Verify installation from a clean directory and write factual release notes. Do not create synthetic usage metrics.
+- GitHub repository: `t1ktakdev/ReproShot`
+- Workflow: `release.yml`
+- Environment: `npm`
 
-GitHub Actions versions were selected from the official [checkout v7.0.1](https://github.com/actions/checkout/releases/tag/v7.0.1) and [setup-node v7.0.0](https://github.com/actions/setup-node/releases/tag/v7.0.0) releases. Dependabot tracks updates.
+No npm token is required by the workflow. Keep `contents: read` and `id-token: write` permissions on the publish job so npm can verify its OIDC identity.
+
+1. Update `package.json`, `package-lock.json`, and `src/types.ts` together. Record user-visible changes in `CHANGELOG.md`.
+2. Run `npm ci --ignore-scripts`, `npm run check`, `npm run demo`, and `npm pack --dry-run`. Review all generated evidence.
+3. Commit the release and wait for the full OS/Node CI matrix to pass.
+4. Create an annotated `v<version>` tag on that verified commit and push only the tag.
+5. Run **Publish npm release** manually on the version tag. Enter the exact version and `publish-reproshot`.
+6. The workflow verifies the tag and package version, reruns the checks, and publishes with npm Trusted Publishing.
+7. Verify the public package from a clean directory, then create the GitHub Release.
+
+Never move a published tag or reuse a published version.