[moshest]

Replaces the long-lived NPM_TOKEN secret in the Release workflow with npm trusted publishing: npm trades GitHub's OIDC token for a short-lived publish credential. Provenance attestations are generated automatically.

Changes (.github/workflows/release.yml)

• Adds id-token: write to the release job.
• Upgrades npm to v11 (trusted publishing needs ≥ 11.5.1). pnpm 10's publish runs the npm CLI, and Node 22 ships with npm 10.
• Drops NODE_AUTH_TOKEN and registry-url. Without the token, setup-node would write an .npmrc with a placeholder token. With NPM_TOKEN unset, changesets/action@v1 detects OIDC and leaves .npmrc alone.

Required before merge

On npmjs.com, go to @neuledge/context → Settings → Trusted Publisher → GitHub Actions: org neuledge, repo context, workflow release.yml, no environment.

No changeset is needed because this only changes CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_018BKJG6eREYeeboG5cQoEDV

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: d365e26

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR