From 162a3f33cbae944b20b3da76f1f4b82d2ff4940e Mon Sep 17 00:00:00 2001
From: owjs3901 <owjs3901@gmail.com>
Date: Thu, 10 Sep 2026 18:22:45 +0900
Subject: [PATCH] ci: publish through npm OIDC trusted publishing

npm rejected the 1.0.4 publish with 404 Not Found, npm's mask for an unauthorized publish - the NPM_TOKEN no longer authenticates.

bun publish cannot perform the npm OIDC token exchange (oven-sh/bun#22423), so trusted publishing needs the publish command itself to be npm. changepacks selects that command from .changepacks/config.json, which overrides the bun.lock-derived default, matching how devup-ui publishes: bun packs the tarball so the packed manifest is unchanged, then npm publishes that tarball over OIDC.

The workflow grants id-token: write, installs Node 24 with npm >= 11.5.1 (the trusted publishing floor), and drops NPM_CONFIG_TOKEN entirely - an empty token still counts as a value to npm and suppresses the OIDC exchange.
---
 .changepacks/config.json      |  7 ++++++-
 .github/workflows/publish.yml | 26 ++++++++++++++++++++++++--
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/.changepacks/config.json b/.changepacks/config.json
index 6b408bf..c06326d 100644
--- a/.changepacks/config.json
+++ b/.changepacks/config.json
@@ -2,6 +2,11 @@
   "ignore": [],
   "baseBranch": "main",
   "latestPackage": null,
-  "publish": {},
+  "publish": {
+    "node": "bun pm pack --quiet --filename .changepacks/publish.tgz && npm publish .changepacks/publish.tgz"
+  },
+  "publishDryRun": {
+    "node": "bun pm pack --quiet --filename .changepacks/publish.tgz && npm publish .changepacks/publish.tgz --dry-run"
+  },
   "updateOn": {}
 }
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 74af544..12e14ce 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -18,19 +18,41 @@ jobs:
       # Actions > General > Workflow permissions for creating pull request
       # Create brench to create pull request
       contents: write
+
+      # Publishes through npm OIDC trusted publishing. This permission lets npm
+      # exchange GitHub's short-lived OIDC token, and public packages receive
+      # provenance automatically.
+      #
+      # PREREQUISITE: bun-test-env-dom must be registered as a Trusted Publisher
+      # on npmjs.com against repo dev-five-git/bun-test-env-dom and workflow file
+      # `publish.yml`. npm matches that filename exactly, so renaming or moving
+      # this file breaks publishing until the entry is updated.
+      id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
       - run: bun i
       - run: |
           bun lint
           bun test
           bun run build
+      # The publish command itself is selected in .changepacks/config.json.
+      # Bun packs the package, then npm publishes that tarball with OIDC (Bun
+      # cannot do OIDC itself: oven-sh/bun#22423).
+      #
+      # No NODE_AUTH_TOKEN is set anywhere: an empty token still counts as a
+      # value to npm and suppresses the OIDC exchange.
+      - name: Install Node.js
+        uses: actions/setup-node@v7
+        with:
+          registry-url: 'https://registry.npmjs.org'
+          node-version: 24
+      - name: Ensure npm >= 11.5.1 (OIDC Trusted Publishing)
+        run: npm install -g npm@latest
       - uses: changepacks/action@main
         id: changepacks
         with:
           publish: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}