ci: publish npm via OIDC trusted publishing (drop NPM_TOKEN)

.github/workflows/release.yml

@@ -42,11 +42,11 @@ jobs:
           # Baked into the binary via ldflags so `rc setup google` works out of the box
           GOOGLE_OAUTH_CLIENT_ID: ${{ secrets.GOOGLE_OAUTH_CLIENT_ID }}
           GOOGLE_OAUTH_CLIENT_SECRET: ${{ secrets.GOOGLE_OAUTH_CLIENT_SECRET }}
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22
           registry-url: https://registry.npmjs.org
+      - name: Upgrade npm (trusted publishing needs npm >= 11.5.1)
+        run: npm install -g npm@11.19.0
       - name: Publish npm packages (@revenuecat/cli + platform binaries)
         run: node scripts/package-npm.mjs --version "${GITHUB_REF_NAME#v}" --dist dist --out npm-dist --publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CHANGELOG.md

@@ -21,6 +21,6 @@ Initial public release of `rc`, the RevenueCat command line interface. It's buil
 ### Install
 - Homebrew: `brew install RevenueCat/tap/rc`
 - npm: `npm install -g @revenuecat/cli`, or run without installing via `npx @revenuecat/cli`
-- Prebuilt binaries on the [releases page](https://github.com/RevenueCat/revenuecat-cli/releases)
+- Prebuilt binaries on the [releases page](https://github.com/RevenueCat/cli/releases)
 
-[0.1.0]: https://github.com/RevenueCat/revenuecat-cli/releases/tag/v0.1.0
+[0.1.0]: https://github.com/RevenueCat/cli/releases/tag/v0.1.0

CONTRIBUTING.md

@@ -6,7 +6,7 @@ Contributions are welcome! Here's how to get going.
 
 ```bash
 brew install mise
-git clone https://github.com/RevenueCat/revenuecat-cli && cd revenuecat-cli
+git clone https://github.com/RevenueCat/cli && cd cli
 mise install          # installs Go 1.25 per mise.toml
 go mod tidy
 make install-hooks    # installs git hooks via lefthook (fmt + vet + test on commit)

npm/cli/README.md

@@ -1,6 +1,6 @@
 # @revenuecat/cli
 
-The [RevenueCat CLI](https://github.com/RevenueCat/revenuecat-cli), installable via npm.
+The [RevenueCat CLI](https://github.com/RevenueCat/cli), installable via npm.
 
 ```bash
 npx @revenuecat/cli --help
@@ -14,4 +14,4 @@ dependencies) and executes it directly. The CLI itself is a native Go binary —
 Node is only used to dispatch.
 
 Also available via Homebrew (`brew install RevenueCat/tap/rc`) and
-[GitHub Releases](https://github.com/RevenueCat/revenuecat-cli/releases).
+[GitHub Releases](https://github.com/RevenueCat/cli/releases).

npm/cli/bin/rc.js

@@ -25,7 +25,7 @@ function binaryPath() {
       "If your platform is listed, your package manager may have skipped optional dependencies (e.g. --no-optional)."
     );
     console.error(
-      "Other install options: `brew install RevenueCat/tap/rc` or https://github.com/RevenueCat/revenuecat-cli/releases"
+      "Other install options: `brew install RevenueCat/tap/rc` or https://github.com/RevenueCat/cli/releases"
     );
     process.exit(1);
   }

npm/cli/package.json

@@ -3,8 +3,8 @@
   "version": "0.0.0-dev",
   "description": "RevenueCat command line interface",
   "keywords": ["revenuecat", "cli", "paywalls", "subscriptions", "in-app purchases"],
-  "homepage": "https://github.com/RevenueCat/revenuecat-cli",
-  "repository": { "type": "git", "url": "git+https://github.com/RevenueCat/revenuecat-cli.git" },
+  "homepage": "https://github.com/RevenueCat/cli",
+  "repository": { "type": "git", "url": "git+https://github.com/RevenueCat/cli.git" },
   "license": "MIT",
   "bin": { "rc": "bin/rc.js", "revenuecat": "bin/rc.js" },
   "files": ["bin/rc.js", "README.md"],

scripts/package-npm.mjs

@@ -4,7 +4,7 @@
 // @revenuecat/cli launcher whose optionalDependencies pin the same version.
 //
 //   node scripts/package-npm.mjs --version 0.2.0 --dist dist --out npm-dist
-//     [--publish]        npm publish (requires NODE_AUTH_TOKEN) instead of npm pack
+//     [--publish]        npm publish instead of npm pack (CI auth is OIDC trusted publishing)
 //     [--allow-missing]  tolerate absent platforms (local dry runs on one machine)
 //
 // Run from the repo root after `goreleaser release` (or `goreleaser build`).
@@ -82,8 +82,8 @@ for (const platform of PLATFORMS) {
     name: pkgName,
     version,
     description: `RevenueCat CLI binary for ${platform.npm}`,
-    homepage: "https://github.com/RevenueCat/revenuecat-cli",
-    repository: { type: "git", url: "git+https://github.com/RevenueCat/revenuecat-cli.git" },
+    homepage: "https://github.com/RevenueCat/cli",
+    repository: { type: "git", url: "git+https://github.com/RevenueCat/cli.git" },
     license: "MIT",
     os: [platform.goos === "windows" ? "win32" : platform.goos],
     cpu: [platform.npm.endsWith("arm64") ? "arm64" : "x64"],