ci: migrate npm publish to Trusted Publishing (OIDC)

[Atharva0506]

Addressed Issues:

N/A — operational CI fix, not tracked by an issue. Context: npm is deprecating "Bypass 2FA" granular access tokens (see https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/). Phase 1 (Aug 2026) already restricts these tokens for sensitive operations, and Phase 2 (~Jan 2027) removes their ability to publish at all, including to existing packages like @aossie-org/social-share-button. This mirrors the same migration already done for ThruBox-Client (AOSSIE-Org/ThruBox-Client#28) and IndexedDB-Import-Export (AOSSIE-Org/IndexedDB-Import-Export#61).

Screenshots/Recordings:

N/A — CI workflow change only.

Additional Notes:

• Removes the NPMJS_TOKEN-based auth from the publish job.
• Adds a pinned npm install -g npm@11.5.1 step, since Trusted Publishing requires npm >= 11.5.1. Pinned to an exact version rather than @latest to avoid pulling unreviewed npm CLI code into a job that holds id-token: write.
• Requires admin action before this is effective: an org owner needs to configure a Trusted Publisher for @aossie-org/social-share-button on npmjs.com (Package Settings → Trusted Publisher → GitHub Actions → org AOSSIE-Org, repo SocialShareButton, workflow version-release.yml, allowed action npm publish). Until that's set up, this workflow will fail since it no longer supplies a token.
• Once a clean release runs through this successfully, the NPMJS_TOKEN secret used here can be removed.

Checklist

• My code follows the project's code style and conventions
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have joined the Discord server and I will share a link to this PR with the project maintainers there
• I have read the Contributing Guidelines

Summary by CodeRabbit

• Chores
  • Updated the release process to use npm 11.5.1 for publishing.
  • Improved package publishing authentication through trusted publishing with provenance enabled.

[coderabbitai]

Warning

Review limit reached

@Atharva0506, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 23bb48a2-4936-4f31-87bf-e6b64369eb00

📥 Commits

Reviewing files that changed from the base of the PR and between 7071163 and 3f7d7e6.

📒 Files selected for processing (1)

• .github/workflows/version-release.yml

Walkthrough

The version release workflow now installs npm 11.5.1 before publication. The npm publish step no longer maps NODE_AUTH_TOKEN and continues to use provenance and public access flags.

Changes

Release publishing

Layer / File(s)	Summary
npm publish setup .github/workflows/version-release.yml	The publish job installs npm 11.5.1. The publish step removes the NODE_AUTH_TOKEN mapping and retains provenance and public access options.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Poem

A rabbit hops through the release line,
“npm is fresh, the flags align!”
No token mapping blocks the way,
Provenance guides the publish day.
The package bounds to the registry bright.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the migration of npm publishing to Trusted Publishing with OIDC.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/version-release.yml:
- Around line 178-180: Restructure the release workflow so the npm upgrade and
package preparation/packing run in a separate job without id-token permissions.
Keep the publish operation in a minimal job that alone grants id-token: write,
and pass the prepared package artifact between jobs for publishing.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 115fbe48-656d-4ce8-947a-32e8eed9e822

📥 Commits

Reviewing files that changed from the base of the PR and between 4715415 and 7071163.

📒 Files selected for processing (1)

• .github/workflows/version-release.yml