fix(ci): publish via OIDC trusted publishing, not a non-existent NPM_TOKEN

[cliffhall]

The 2.0.0-rc.1 publish failed with npm error code ENEEDAUTH. Part of #1818.

Nothing was published and no version was consumed — the run failed before npm publish wrote anything. latest is still 1.0.1 and 2.0.0-rc.1 does not exist on npm.

Root cause — two problems, both in a job that had never run

Every previous release was cut from the v1 workflow. The v2 publish job has existed since the v2 branch was created but was executed for the first time tonight.

1. NODE_AUTH_TOKEN pointed at a secret that does not exist.

env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

The repo has no secrets at either repo or environment level — publishing moved to npm OIDC trusted publishing, which needs no token. With the secret absent, setup-node still writes its .npmrc with an empty _authToken, and npm fails ENEEDAUTH before OIDC is ever attempted.

2. The job never upgraded the npm CLI.

Trusted publishing requires npm >= 11.5.1; Node 22 bundles 10.x. So this would have failed even with the token line removed. The v1 workflow carries this step — v2 was missing it.

The fix

+      - name: Ensure npm CLI supports OIDC trusted publishing
+        run: npm install -g npm@^11.5.1
+
       - name: Install dependencies (root + all clients)

           npm publish --access public --provenance --tag "$NPM_TAG"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Both now match the v1 publish job, which did successfully publish 1.0.1 from v1/main in #1815.

The publish step carries a comment explaining why there is deliberately no NODE_AUTH_TOKEN, since re-adding it looks like an obvious fix and would silently break publishing again.

Bonus: #1834 is confirmed working

Before failing on auth, the run logged:

Publishing 2.0.0-rc.1 under dist-tag 'next'

So the dist-tag derivation is correct — latest was never at risk.

Why the RC was worth doing

This is exactly what §6 wanted an RC for. Both defects are invisible to pack:verify and to every local check: they only exist in the interaction between the workflow, GitHub's OIDC, and the live registry. Catching them on a throwaway prerelease number instead of on 2.0.0 is the whole point.

Also

README.md documented NPM_TOKEN as part of the publish setup — corrected to describe trusted publishing, including the npm version requirement and a warning that adding the token back breaks it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD