chore: switch npm publishing to trusted publishing, drop NPM_TOKEN

[Copilot]

Both publishing workflows still passed NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} despite already having id-token: write and environment: npm configured for OIDC trusted publishing. This removes the legacy token-based auth.

Changes

• .github/workflows/release-please.yml — remove NODE_AUTH_TOKEN env from publish-npm job; automated publishing via Release Please remains unchanged
• .github/workflows/npm-publish.yml — same removal; manual workflow_dispatch fallback is preserved

Result

# before
- name: Publish to npm
  run: npm publish --provenance --access public
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

# after
- name: Publish to npm
  run: npm publish --provenance --access public

Publishing stays automated through release-please.yml (triggered on release creation, avoiding the prior GITHUB_TOKEN trigger-suppression issue). npm-publish.yml remains as a manual recovery path. Both now rely solely on the npm trusted publisher OIDC configuration.

[Primajin]

@copilot but I have asked you if the npm publish could be automated again. It is still set to workflow dispatch, which reads as "manual button press" to me. Before we had the issue that it didn't start when set to "on release" - is that now possible again?

[Copilot]

@copilot but I have asked you if the npm publish could be automated again. It is still set to workflow dispatch, which reads as "manual button press" to me. Before we had the issue that it didn't star...

Publishing is already fully automated — no button press needed. The publish-npm job in release-please.yml fires automatically every time Release Please creates a release (triggered by a push to main).

npm-publish.yml is intentionally kept as a manual fallback only. Changing it to on: release would not work: GitHub prevents workflows triggered by GITHUB_TOKEN (which Release Please uses to create releases) from cascading into separate on: release workflows — that was the original automation failure. The fix was to put the publish step directly inside release-please.yml, where it already runs automatically today.

[Primajin]

@copilot but how could I automatically push a new release to npm once release please created the release? Is there really no way?

[Copilot]

@copilot but how could I automatically push a new release to npm once release please created the release? Is there really no way?

It already does — that's exactly what the publish-npm job in release-please.yml does. Here's the flow:

1. You push/merge to main
2. release-please.yml runs → Release Please creates or updates a release PR
3. When that release PR is merged, release-please.yml runs again → Release Please creates the GitHub release and the publish-npm job runs automatically in the same workflow (no button press, no separate trigger needed)

The key is if: needs.release-please.outputs.release_created == 'true' on the publish-npm job — it only fires when Release Please actually creates a release, and it's in the same workflow so it bypasses the GITHUB_TOKEN trigger-suppression issue entirely.

npm-publish.yml is a separate manual-only safety net for edge cases (e.g. if the automated job failed and you need to retry). It doesn't replace the automation.

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://Primajin.github.io/Gyros/pr-preview/pr-41/
Built to branch gh-pages at 2026-07-11 06:26 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[Copilot]

Pull request overview

This PR updates the repository’s npm publishing GitHub Actions workflows to rely exclusively on npm’s OIDC trusted publishing (via id-token: write + environment: npm) by removing the legacy NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} configuration.

Changes:

• Remove NODE_AUTH_TOKEN from the npm publish step in the Release Please-driven publishing workflow.
• Remove NODE_AUTH_TOKEN from the manual workflow_dispatch npm publishing workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/release-please.yml	Removes legacy token-based npm auth from the automated publish job, leaving OIDC trusted publishing as the only auth mechanism.
.github/workflows/npm-publish.yml	Removes legacy token-based npm auth from the manual publish workflow to match OIDC trusted publishing usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Primajin]

@copilot ok then one final change please. In an earlier commit we removed the link to npm from the demo page because it pointed to the wrong gyros npm package - now that we have our own package under my namespace we can bring back that link

[github-actions]

2026-07-11T06:25:11.255Z-iPad_Pro_landscape-eba1356.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-11T06.25.11.255Z-iPad_Pro_landscape-eba1356.png

2026-07-11T06:25:11.255Z-iPad_Pro-eba1356.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-11T06.25.11.255Z-iPad_Pro-eba1356.png

2026-07-11T06:25:11.255Z-iPhone_13-eba1356.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-11T06.25.11.255Z-iPhone_13-eba1356.png

[github-actions]

Console Logs

✅ No logs were captured

[Copilot]

@copilot ok then one final change please. In an earlier commit we removed the link to npm from the demo page because it pointed to the wrong gyros npm package - now that we have our own package under ...

Done in commit 84ab999 — the demo footer now includes the npm link again, pointing to @primajin/gyros (https://www.npmjs.com/package/@primajin/gyros).

[github-actions]

2026-07-11T06:29:17.626Z-iPad_Pro_landscape-c8daf67.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-11T06.29.17.626Z-iPad_Pro_landscape-c8daf67.png

2026-07-11T06:29:17.626Z-iPad_Pro-c8daf67.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-11T06.29.17.626Z-iPad_Pro-c8daf67.png

2026-07-11T06:29:17.626Z-iPhone_13-c8daf67.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-11T06.29.17.626Z-iPhone_13-c8daf67.png