From 544c907d445a0ae106c2dfc31c8b285e676106a4 Mon Sep 17 00:00:00 2001
From: Janghoon Lee <44862514+savagemanage@users.noreply.github.com>
Date: Tue, 13 Oct 2026 05:17:42 +0000
Subject: [PATCH] ci(sdk): publish through npm trusted publishing when no token
 is set

The 0.6.0 publish failed at "NPM_TOKEN is not set": the token the 0.4.1 publish used is gone, and the
package is meant to publish through npm's trusted publishing instead. That needs `id-token: write`
on the job and npm >= 11.5.1, which the runner's default Node does not carry; with both, `npm publish`
exchanges the GitHub OIDC token for a short-lived credential and attaches provenance on its own.

NPM_TOKEN still wins when it is set, so nothing changes for a repository that keeps one. The trust
itself lives on npmjs.com (package > Settings > Trusted publisher: redrob-labs/redrob-code,
publish-sdk.yml) and is not something this file can grant.
---
 .github/workflows/publish-sdk.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-sdk.yml b/.github/workflows/publish-sdk.yml
index 09ac5f2975..0e5a3f257b 100644
--- a/.github/workflows/publish-sdk.yml
+++ b/.github/workflows/publish-sdk.yml
@@ -44,8 +44,13 @@ concurrency:
   group: publish-sdk
   cancel-in-progress: false
 
+# `id-token: write` is what npm trusted publishing needs: npm exchanges the GitHub OIDC token for a
+# short-lived publish credential, so no NPM_TOKEN secret is stored anywhere. The trust is configured
+# on npmjs.com (package settings > Trusted publisher: this repository, this workflow file). When
+# NPM_TOKEN IS set it still wins, so the old path keeps working during the switch.
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
@@ -62,6 +67,12 @@ jobs:
 
       - uses: ./.github/actions/setup-bun
 
+      # Trusted publishing needs npm >= 11.5.1 (Node 24 ships one); the runner's default is older.
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+      - run: npm install -g npm@latest && npm --version
+
       - id: resolve
         env:
           REQUESTED: ${{ inputs.version }}
@@ -100,8 +111,8 @@ jobs:
         run: |
           set -euo pipefail
           if [ -z "${NPM_TOKEN:-}" ]; then
-            echo "::error::NPM_TOKEN is not set for this repository or its organization"
-            exit 1
+            echo "no NPM_TOKEN: publishing through npm trusted publishing (OIDC)"
+            exit 0
           fi
           echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
           if ! who="$(npm whoami 2>&1)"; then