From a18524f476be655942cd9da1ce732f0752dcadf5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Elberte=20Pl=C3=ADnio?= <elberte.dev@gmail.com>
Date: Thu, 9 Jul 2026 21:50:06 -0300
Subject: [PATCH] ci: publish to npm via trusted publishing (OIDC)

Replace NPM_TOKEN auth with OIDC trusted publishing so publish tokens
never expire again. Add repository metadata to all packages and enable
provenance attestation.

Refs #23
---
 .github/workflows/publish.yml       | 6 ++----
 packages/auth/package.json          | 5 +++++
 packages/billing/package.json       | 5 +++++
 packages/brand/package.json         | 5 +++++
 packages/edge-shared/package.json   | 5 +++++
 packages/flags/package.json         | 5 +++++
 packages/sync/package.json          | 5 +++++
 packages/tauri-release/package.json | 5 +++++
 8 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 42bb223..afc61f1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
@@ -16,12 +17,9 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: 24
-          registry-url: https://registry.npmjs.org
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.12
       - run: bun install --frozen-lockfile
       - run: bun run check
-      - run: npm publish --workspaces --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm publish --workspaces --access public --provenance
diff --git a/packages/auth/package.json b/packages/auth/package.json
index ac99c7d..2e802ab 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.0",
   "description": "UI-free Supabase Auth and entitlements wrapper for Pickforge apps.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pickforge/pickforge-platform.git",
+    "directory": "packages/auth"
+  },
   "type": "module",
   "files": [
     "dist"
diff --git a/packages/billing/package.json b/packages/billing/package.json
index 13b0c34..71c4f6e 100644
--- a/packages/billing/package.json
+++ b/packages/billing/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.0",
   "description": "UI-free Stripe billing and credit-ledger helpers for Pickforge apps.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pickforge/pickforge-platform.git",
+    "directory": "packages/billing"
+  },
   "type": "module",
   "files": [
     "dist"
diff --git a/packages/brand/package.json b/packages/brand/package.json
index 8138a47..d38ebd1 100644
--- a/packages/brand/package.json
+++ b/packages/brand/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.0",
   "description": "Pickforge CSS tokens, fonts, reset, and primitives.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pickforge/pickforge-platform.git",
+    "directory": "packages/brand"
+  },
   "type": "module",
   "sideEffects": [
     "**/*.css"
diff --git a/packages/edge-shared/package.json b/packages/edge-shared/package.json
index a60fc9d..a671ff2 100644
--- a/packages/edge-shared/package.json
+++ b/packages/edge-shared/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.0",
   "description": "Deno-compatible shared helpers for Pickforge Edge Functions.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pickforge/pickforge-platform.git",
+    "directory": "packages/edge-shared"
+  },
   "type": "module",
   "files": [
     "dist"
diff --git a/packages/flags/package.json b/packages/flags/package.json
index 455dcc6..60ca48e 100644
--- a/packages/flags/package.json
+++ b/packages/flags/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.0",
   "description": "UI-free feature-flag registry for release gating in Pickforge apps.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pickforge/pickforge-platform.git",
+    "directory": "packages/flags"
+  },
   "type": "module",
   "files": [
     "dist"
diff --git a/packages/sync/package.json b/packages/sync/package.json
index 8d08156..dcaa8e4 100644
--- a/packages/sync/package.json
+++ b/packages/sync/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.0",
   "description": "UI-free settings sync helpers for Pickforge apps.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pickforge/pickforge-platform.git",
+    "directory": "packages/sync"
+  },
   "type": "module",
   "files": [
     "dist"
diff --git a/packages/tauri-release/package.json b/packages/tauri-release/package.json
index dfa7c14..ea355bf 100644
--- a/packages/tauri-release/package.json
+++ b/packages/tauri-release/package.json
@@ -3,6 +3,11 @@
   "version": "0.6.0",
   "description": "Signed Tauri release and updater-feed automation for Pickforge apps.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pickforge/pickforge-platform.git",
+    "directory": "packages/tauri-release"
+  },
   "type": "module",
   "bin": {
     "pickforge-tauri-release": "dist/cli.js"