reactivando / use-pubsub-js / 28085492498

100%

master: 80%

push

github

ci(release): publish via npm Trusted Publishing (OIDC), drop NPM_TOKEN (#63)

Migrate release.yml to npm Trusted Publishing using the workflow's
existing `id-token: write` permission instead of a long-lived token.

- Remove NODE_AUTH_TOKEN / NPM_TOKEN from the publish step; keep
  NPM_CONFIG_PROVENANCE and add publishConfig.provenance to package.json.
- Bump .nvmrc to Node 24 so the runner ships npm >= 11.5.1 (required for
  OIDC publishing). release-it / release-it-pnpm and .release-it.json are
  unchanged — release-it-pnpm still runs `pnpm publish`, which performs
  the OIDC token exchange under npm >= 11.5.1.

Mirrors the sibling validations-br release workflow. Validated locally on
Node 24 with `release-it --dry-run` (computes 1.3.2 -> 1.3.3, generates
changelog, would tag/commit; nothing published or pushed). Build + tests
(19) + lint + e2e green.

Requires a one-time npmjs.com trusted-publisher setup (handed off
separately) before the next release.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

11 of 11 branches covered (100.0%)

Branch coverage included in aggregate %.

63 of 64 relevant lines covered (98.44%)

7.98 hits per line