ci(release): publish to npm with trusted publishing (OIDC)

.github/workflows/release.yml

@@ -53,7 +53,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v7
         with:
-          node-version: "22.x"
+          node-version: "24.x"
           registry-url: "https://registry.npmjs.org"
           cache: npm
 
@@ -113,6 +113,9 @@ jobs:
 
       # Idempotent: re-running the job after a partial failure won't hard-fail
       # on npm's 409 for an already-published version.
+      # Publishes via npm trusted publishing (OIDC): needs `id-token: write`
+      # and npm >= 11.5.1; the trusted publisher is configured on npmjs.com for
+      # this repo and `release.yml`; no NPM_TOKEN secret is involved.
       - name: Publish to npm
         run: |
           PKG="$(node -p "require('./package.json').name")"
@@ -122,8 +125,6 @@ jobs:
           else
             npm publish --provenance --access public --tag "${{ steps.version.outputs.NPM_TAG }}"
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3

CONTRIBUTING.md

@@ -62,11 +62,14 @@ The release job will:
 3. Publish to npm with [provenance attestation](https://docs.npmjs.com/generating-provenance-statements).
 4. Create a GitHub Release with auto-generated release notes.
 
+npm publishing uses [trusted publishing (OIDC)](https://docs.npmjs.com/trusted-publishers)
+configured on npmjs.com for this repository (`stablekernel/opencode-cursor`, workflow
+`release.yml`), so no npm token secret is needed.
+
 **Required repository secrets** (Settings → Secrets → Actions):
 
 | Secret | Purpose |
 | --- | --- |
-| `NPM_TOKEN` | npm automation token with `publish` access |
 | `CURSOR_API_KEY` | (optional) live-path integration test during release |
 
 **Pre-publish checklist:** update `CHANGELOG.md`, confirm `version` in