Greptile Summary

This PR successfully migrates the npm publishing workflow from token-based authentication to npm Trusted Publishers using OIDC, providing enhanced security and cryptographic provenance for published packages.

Key Changes:

• Upgraded Node.js to version 24 (required for npm 11+ which supports Trusted Publishers)
• Added id-token: write permission to enable OIDC token generation for GitHub Actions
• Added --provenance flag to publish commands for cryptographic proof of package origin
• Removed NODE_AUTH_TOKEN environment variable and NPM_TOKEN secret dependency

Security Improvements:

• Eliminates need for long-lived npm tokens stored as GitHub secrets
• Uses short-lived OIDC tokens for authentication
• Provides cryptographic provenance linking published packages to source code and build process
• Reduces attack surface by removing manual token management

Confidence Score: 5/5

• This PR is safe to merge with no risk - the changes follow npm Trusted Publishers best practices correctly
• The implementation correctly follows npm Trusted Publishers specification with proper OIDC permissions, appropriate Node version upgrade, and correct provenance flags. All changes are additive security improvements with no breaking changes or security concerns.
• No files require special attention

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant GHA as GitHub Actions
    participant OIDC as GitHub OIDC Provider
    participant npm as npm Registry
    participant Pkg as Published Package
    
    Note over GHA,npm: Release triggered (manual or release event)
    
    GHA->>GHA: Checkout code
    GHA->>GHA: Setup Node 24 & pnpm 10
    GHA->>GHA: Install dependencies
    GHA->>GHA: Build project
    
    Note over GHA,OIDC: OIDC Authentication Flow
    GHA->>OIDC: Request OIDC token<br/>(id-token: write permission)
    OIDC->>GHA: Return signed JWT token
    
    Note over GHA,npm: Trusted Publishers Authentication
    GHA->>npm: Publish with --provenance flag<br/>(includes OIDC token)
    npm->>npm: Verify OIDC token signature
    npm->>npm: Check Trusted Publishers config
    npm->>npm: Validate repository/workflow
    
    npm->>Pkg: Publish package with provenance
    npm->>GHA: Success response
    
    Note over Pkg: Package includes cryptographic<br/>proof of origin