Migrate npm publishing to trusted publishing (OIDC) — kill NPM_TOKEN rotation

[ElbertePlinio]

Goal: stop npm publish tokens from expiring by migrating CI publishing to npm trusted publishing (OIDC). No stored token, nothing to rotate.

Context: NPM_TOKEN expiry email received 2026-07-09. npm granular write tokens are capped at 90 days and classic tokens are revoked, so rotation emails are permanent unless we go tokenless.

PR plan

• PR 1 — pickforge-platform publish.yml → OIDC
  • Touches: .github/workflows/publish.yml (add id-token: write, drop NODE_AUTH_TOKEN)
  • Validation: next tag publish succeeds via OIDC
  • Link: pending
• PR 2 — picklab release.yml → OIDC
  • Touches: .github/workflows/release.yml (add id-token: write, drop NODE_AUTH_TOKEN, Node 20 → 24 for npm ≥ 11.5.1)
  • Validation: next picklab release publishes via OIDC
  • Link: pending

Manual steps (npmjs.com, browser — Elberte)

Configure GitHub Actions trusted publisher on each package (Settings → Trusted Publisher):

• @pickforge/auth — repo pickforge/pickforge-platform, workflow publish.yml
• @pickforge/billing — same
• @pickforge/brand — same
• @pickforge/edge-shared — same
• @pickforge/flags — same
• @pickforge/sync — same
• @pickforge/tauri-release — same
• @pickforge/picklab — repo pickforge/picklab, workflow release.yml

Cleanup

• Verify one real publish per repo via OIDC
• Delete NPM_TOKEN secret on pickforge-platform
• Delete NPM_TOKEN secret on picklab
• Revoke leftover npm tokens on npmjs.com

Ordering note: merging the PRs is safe before the npmjs.com config (publish only runs on tags), but a tag pushed after merge and before trusted-publisher config will fail to publish. Do the browser steps first.

Current status: Planned
Next action: PR 1

[ElbertePlinio]

Progress update:

• PR 1 opened: ci: publish to npm via trusted publishing (OIDC) #24 (also adds repository fields + provenance)
• PR 2 opened: ci: publish to npm via trusted publishing (OIDC) picklab#13
• Codex review loop on both
• npmjs.com trusted publisher config (8 packages) — Elberte, browser
• Verify one OIDC publish per repo, then delete both NPM_TOKEN secrets

Next: Codex reviews in flight

[ElbertePlinio]

Progress update:

• PR 1 merged: ci: publish to npm via trusted publishing (OIDC) #24 (Codex clean, CI green)
• PR 2 merged: ci: publish to npm via trusted publishing (OIDC) picklab#13 (Codex clean, CI green)
• npmjs.com trusted publisher config — in progress (picklab form filled; 7 platform packages remain)
• Verify first OIDC publish per repo
• Delete NPM_TOKEN secrets on both repos; revoke leftover tokens on npmjs.com
• Optional hardening: switch each package to "require 2FA and disallow tokens" after OIDC verified

Next: Elberte finishes trusted-publisher config in browser

[ElbertePlinio]

Progress update:

• Trusted publisher configured on npmjs.com (all 8 packages, done by Elberte)
• OIDC verified on pickforge-platform: dispatch run 29061718570 authenticated via OIDC (failed only on the expected republish-conflict for 0.6.0)
• NPM_TOKEN secret deleted on pickforge-platform
• NPM_TOKEN secret deleted on picklab
• picklab end-to-end proof on its next tagged release (config identical, low risk)
• Optional: revoke leftover tokens on npmjs.com + flip packages to 'require 2FA and disallow tokens'

Next: close after next picklab release publishes via OIDC