[mangelsnc]

Third attempt at fixing the broken release pipeline. Previous attempts:

• v2.3.1 failed: removed workflow_dispatch (correct), but setup-node@v4 + registry-url injects a placeholder NODE_AUTH_TOKEN that npm CLI picks up over OIDC. Got 404.
• v2.3.2 failed: dropped registry-url to avoid the placeholder. But then npm CLI has no registry config at all and returns ENEEDAUTH.

Root cause

actions/setup-node@v4 and earlier exports NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX as a placeholder env var when you pass registry-url. The npm CLI uses that placeholder for auth and never falls back to OIDC.

actions/setup-node@v6 (Oct 2025) changed this behavior: it no longer injects the placeholder, so the npm CLI's documented OIDC-first auth path actually runs.

This matches the official npm Trusted Publishing example, which uses setup-node@v6 with registry-url set and package-manager-cache: false.

Changes

• actions/setup-node@v4 → @v6 (only in release.yml; ci.yml keeps v4 since it does not publish).
• Restore registry-url: https://registry.npmjs.org (safe again with v6).
• Add package-manager-cache: false per npm's published guidance for release builds.

Cleanup

• Tag 2.3.2 and the GitHub Release 2.3.2 have been deleted (no npm package existed, nothing to break).
• [2.3.2] CHANGELOG entry folded into a new [2.3.3] entry documenting both fixes.

Release procedure once this lands

git checkout main && git pull
git tag 2.3.3
git push origin 2.3.3

Test plan

• CI passes on this PR.
• After merge, pushing tag 2.3.3 runs the workflow end to end.
• npm view undisclosed@2.3.3 version returns 2.3.3.
• npm view undisclosed dist-tags.latest returns 2.3.3.
• Provenance attestation is visible on the npm package page.