ci: migrate npm publish to Trusted Publishing (OIDC)

[Atharva0506]

Addressed Issues:

N/A — operational CI fix, not tracked by an issue. Context: npm is deprecating "Bypass 2FA" granular access tokens (see https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/). Phase 1 (Aug 2026) already blocks these tokens from creating new packages, which is why @aossie-org/thrubox-client's first publish kept failing with a 404 in CI. Phase 2 (~Jan 2027) removes their ability to publish at all, even to existing packages.

Screenshots/Recordings:

N/A — CI workflow change only.

Additional Notes:

• Removes the NPMJS_TOKEN-based auth and the now-unnecessary "Verify npm authentication" step from the publish job.
• Adds an npm install -g npm@latest step, since Trusted Publishing requires npm >= 11.5.1 (CI currently runs 10.9.8).
• @aossie-org/thrubox-client was manually bootstrap-published to create the package for the first time (npm has no "pending publisher" support for brand-new packages).
• Requires admin action before this is effective: an org owner needs to configure a Trusted Publisher for this package on npmjs.com (Package Settings → Trusted Publisher → GitHub Actions → org AOSSIE-Org, repo ThruBox-Client, workflow version-release.yml, allowed action npm publish). Until that's set up, this workflow will fail since it no longer supplies a token.
• Once a clean release runs through this successfully, the org-level NPMJS_TOKEN secret can be removed.

Checklist

• My code follows the project's code style and conventions
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have joined the Discord server and I will share a link to this PR with the project maintainers there
• I have read the Contributing Guidelines

Summary by CodeRabbit

• Chores
  • Updated the release process to use the latest npm version.
  • Simplified package publishing with automated package preparation.
  • Retained provenance and public access settings for npm packages.

[github-actions]

	Messages
📖	⚠️ PR Template Check These are non-blocking, but please fix: No issue linked. Consider adding Fixes #<number> (e.g. Fixes #42) under the Addressed Issues section. Some required checklist items are not completed: My PR addresses a single issue

Generated by 🚫 dangerJS against e736291

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: aff380a5-ac7f-40a4-ac21-5635e913f621

📥 Commits

Reviewing files that changed from the base of the PR and between a29c5a2 and e736291.

📒 Files selected for processing (1)

• .github/workflows/version-release.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• AOSSIE-Org/ThruBox-Server (manual)

---

Walkthrough

The release workflow now builds an npm tarball in a separate job. The publish job downloads the tarball, installs npm 11.5.1, and publishes with provenance and public access. Manual token verification and token-based publishing configuration are removed.

Changes

npm release workflow

Layer / File(s)	Summary
Build and package the release .github/workflows/version-release.yml	A conditional build job uses read-only contents permission and Node 22. It creates and uploads the npm package tarball.
Publish the packaged release .github/workflows/version-release.yml	The publish job downloads the tarball, installs npm@11.5.1, and publishes with provenance and public access. It removes manual token checks and token environment configuration.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• AOSSIE-Org/ThruBox-Client#16: Both changes modify the release workflow.
• AOSSIE-Org/ThruBox-Client#21: Both changes modify npm publish authentication behavior.

Sequence Diagram(s)

sequenceDiagram
  participant Release
  participant Build
  participant Artifact
  participant Publish
  participant NPM
  Release->>Build: Start after published release
  Build->>Artifact: Create and upload npm tarball
  Publish->>Artifact: Download npm tarball
  Publish->>Publish: Install npm@11.5.1
  Publish->>NPM: Publish with provenance and public access

Loading

Poem

A rabbit watches packages grow,
The build job makes the tarball flow.
Publish brings it to npm’s door,
Provenance guards the public store.
Hop, the release is ready! 🐇

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the migration of npm publishing to Trusted Publishing with OIDC.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/version-release.yml:
- Around line 173-175: Update the “Update npm for Trusted Publishing” workflow
step to install a specific pinned npm CLI version compatible with Node 22 and
Trusted Publishing instead of npm@latest. Keep future version changes explicit
by requiring an intentional workflow update.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fb7b8d12-52a0-47d8-85a8-ea51b45d9654

📥 Commits

Reviewing files that changed from the base of the PR and between a29c5a2 and b0634c2.

📒 Files selected for processing (1)

• .github/workflows/version-release.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• AOSSIE-Org/ThruBox-Server (manual)

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.