From bc434f9fd885d854d0466706de150e210548c278 Mon Sep 17 00:00:00 2001
From: Robert DeRienzo <rderienzo@voloridge.com>
Date: Fri, 9 Oct 2026 17:12:32 +0000
Subject: [PATCH] ci: publish to npm through trusted publishing with staged
 releases

The 2.0.0 publish failed with E404 because NPM_TOKEN expired. Publish
through the trusted publisher instead, which allows only
`npm stage publish`:

- Install npm 11; the runner's npm 10 cannot do the OIDC exchange.
- Replace `npm publish` and NODE_AUTH_TOKEN with `npm stage publish`.
  Trusted publishing adds provenance itself.
- Add a workflow_dispatch trigger with a tag input, to publish a tag
  whose release already exists (v2.0.0).
---
 .github/workflows/release-please.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 8a4650d..88541de 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -3,6 +3,11 @@ name: Release Please
 on:
   push:
     branches: [main]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to publish, e.g. v2.0.0"
+        required: true
 
 permissions:
   contents: write
@@ -25,20 +30,23 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     needs: release-please
-    if: ${{ needs.release-please.outputs.release_created }}
+    if: ${{ needs.release-please.outputs.release_created || github.event_name == 'workflow_dispatch' }}
     permissions:
       contents: read
       id-token: write
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag || github.sha }}
       - uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: npm
           registry-url: "https://registry.npmjs.org"
+      # Trusted publishing allows only `npm stage publish`, which needs npm >= 11.15.0.
+      - run: npm install -g npm@11
       # tsc and npm publish load no native addon.
       - run: npm ci --ignore-scripts
       - run: npm run build
-      - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      # Stages the release; a maintainer approves it on npmjs.com with 2FA.
+      - run: npm stage publish