From f1579fc0d151ddbf38bfdf3fc2b02f5902297463 Mon Sep 17 00:00:00 2001
From: Abimael Martell <abimex@gmail.com>
Date: Thu, 2 Apr 2026 12:08:04 -0700
Subject: [PATCH] use npm trusted publisher (OIDC provenance) instead of
 NPM_TOKEN

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 95ecd26..6f46a7e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,7 +6,7 @@ on:
 
 permissions:
   contents: read
-  packages: write
+  id-token: write
 
 jobs:
   build:
@@ -79,12 +79,10 @@ jobs:
       - name: Collect binaries and publish
         working-directory: napi
         run: |
-          echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
-
           # Copy all .node binaries into the package directory
           cp artifacts/bindings-*/*.node .
 
           echo "=== Package contents ==="
           ls -la *.node index.js index.d.ts
 
-          npm publish --access public
+          npm publish --access public --provenance