fix(ci): publish via npm trusted publishing instead of a stale token

[ericviana]

Problem

publish.yml has failed on every run since 2026-05-15 (13 failures, 2 successes ever). npm is stuck at 0.1.1 while main is at 0.4.0, so the receivers to customers command rename has never reached users.

The build is fine. Only the registry call fails:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@blindpay%2fcli - Not found
npm error 404  The requested resource '@blindpay/[email protected]' could not be found
               or you do not have permission to access it.

Cause

The job passed NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}. setup-node writes that into .npmrc as _authToken, which takes precedence over the OIDC exchange and disables trusted publishing. The secret was created 2026-03-06, and npm granular tokens expire within 90 days, so it died in early June.

The timeline separates the two failure modes cleanly:

Date	Version	Error
2026-05-15 20:06	0.1.1	cannot publish over the previously published versions (benign)
2026-06-17 onward	0.2.0, 0.3.0, 0.3.1, 0.4.0	E404 on auth (real)

blindpay-node/.github/workflows/publish.yaml is byte-identical except that it passes no token, and it publishes successfully with SLSA provenance attestations (npm view @blindpay/node dist.attestations). This aligns cli with it.

A trusted publisher is now configured on npmjs.com for @blindpay/cli, pointing at blindpaylabs/blindpay-cli and publish.yml, with npm publish and npm stage publish permissions.

Changes

• Drop the NODE_AUTH_TOKEN env block so the OIDC exchange runs. id-token: write was already present.
• Skip instead of fail when package.json's version is already on the registry. The job runs on every push to main, so an unchanged version failed the run and buried real failures in noise.
• Tag and create a GitHub release on publish. The repo has no tags at all today.
• Drop ref: ${{ github.head_ref }}, which is empty on a push event.

Verification

• bun install --frozen-lockfile and bun run build pass locally on this branch (bundled 20 modules, 122.95 KB entry point).
• publish.yml parses as valid YAML.
• Merging this publishes 0.4.0 and creates tag v0.4.0.

Follow-up

Once a publish succeeds, the dead secret can go:

gh secret delete NPM_TOKEN --repo blindpaylabs/blindpay-cli

https://claude.ai/code/session_01F1stiNzuNtJXoXtiW9ZCbs