From e13687dd75d278b3ee2b59a8fecf379dedc03b58 Mon Sep 17 00:00:00 2001
From: Wesley B <62723358+wesleyboar@users.noreply.github.com>
Date: Mon, 13 Jul 2026 16:09:57 -0500
Subject: [PATCH 1/2] ci: publish to npm via Trusted Publisher (OIDC) instead
 of token

Switch npm-publish workflow to OIDC-based Trusted Publishing, removing
the NPM_TOKEN secret dependency. Also collapse the separate build and
publish jobs into a single job (one npm install, then test then publish),
bump actions to v6, and update Node to 24.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/npm-publish.yml | 31 ++++++++++++-------------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index b0ab118..e8e9dcb 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -1,4 +1,4 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
+# This workflow will run tests using node and then publish a package to NPM when a release is created
 # For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
 
 name: Node.js Package
@@ -6,28 +6,21 @@ name: Node.js Package
 on:
   release:
     types: [created]
+  workflow_dispatch: {}
+
+permissions:
+  id-token: write  # Required for OIDC
 
 jobs:
-  build:
+  publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: 20
-      - run: npm ci
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false  # never use caching in release builds
+      - run: npm install
       - run: npm test
-
-  publish-npm:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          registry-url: https://registry.npmjs.org/
-      - run: npm ci
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}

From 6bd784fd26142ef4a80a49ba4938b56838aa7e5a Mon Sep 17 00:00:00 2001
From: Wesley B <62723358+wesleyboar@users.noreply.github.com>
Date: Mon, 13 Jul 2026 16:36:11 -0500
Subject: [PATCH 2/2] fix: add repository field required for npm provenance

Trusted Publishing signs provenance, which requires package.json
"repository.url" to match the GitHub repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 package.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/package.json b/package.json
index 69cfb6a..9e1d0e2 100644
--- a/package.json
+++ b/package.json
@@ -16,6 +16,13 @@
     "dist"
   ],
   "homepage": "https://github.com/TACC/Core-Components",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TACC/Core-Components.git"
+  },
+  "bugs": {
+    "url": "https://github.com/TACC/Core-Components/issues"
+  },
   "scripts": {
     "start": "storybook dev --port 9000",
     "build-demo": "storybook build --output-dir demo",