ci: migrate npm publish to Trusted Publishing (OIDC)

.github/workflows/version-release.yml

@@ -149,14 +149,13 @@ jobs:
             echo "- **GitHub Release:** ✗ (no draft found)" >> $GITHUB_STEP_SUMMARY
           fi
 
-  publish:
+  build:
     needs: release
     if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.release.outputs.released == 'true' }}
     runs-on: ubuntu-latest
 
     permissions:
       contents: read
-      id-token: write
 
     steps:
       - name: Checkout code
@@ -165,10 +164,9 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
         run: npm ci
@@ -187,33 +185,43 @@ jobs:
       - name: Run tests
         run: npm test
 
-      - name: Verify package contents
-        run: npm pack --dry-run
+      - name: Pack package
+        run: npm pack --pack-destination /tmp/pack
 
-      - name: Verify npm authentication
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_TOKEN }}
-        run: |
-          if [ -z "$NODE_AUTH_TOKEN" ]; then
-            echo "::error::NPMJS_TOKEN secret is not set. Configure it in repo Settings → Secrets → Actions."
-            exit 1
-          fi
-          echo "✓ NPMJS_TOKEN secret is present"
-          echo "Node: $(node -v) | npm: $(npm -v)"
-          echo "Registry: $(npm config get registry)"
-          cat ~/.npmrc 2>/dev/null | sed 's/_authToken=.*/_authToken=***/' || true
-          NPM_USER=$(npm whoami 2>&1) || {
-            echo "::error::npm authentication failed. The NPMJS_TOKEN may be expired or invalid."
-            echo "npm whoami output: $NPM_USER"
-            exit 1
-          }
-          echo "✓ Authenticated as: $NPM_USER"
-          npm org ls aossie-org "$NPM_USER" 2>&1 || echo "⚠ Could not verify org membership"
+      - name: Upload package tarball
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: npm-package
+          path: /tmp/pack/*.tgz
+          retention-days: 1
+
+  publish:
+    needs: [release, build]
+    if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.release.outputs.released == 'true' }}
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Download package tarball
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: npm-package
+          path: /tmp/pack
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Update npm for Trusted Publishing
+        run: npm install -g npm@11.5.1
 
       - name: Publish to npm
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPMJS_TOKEN }}
+        run: npm publish /tmp/pack/*.tgz --provenance --access public
 
       - name: Publish Summary
         run: |