release: npm trusted publishing (OIDC, no tokens)

.github/workflows/release.yml

@@ -1,28 +1,33 @@
 name: release
 
+# Release: tag v* to publish `interscript-ts` to npm via TRUSTED PUBLISHING
+# (OIDC — no long-lived tokens).
+#
+# One-time manual setup:
+# 1. Manually publish ONCE (npm publish --access public)
+# 2. On npmjs.com: Settings → Trusted publishing → GitHub Actions →
+# org `interscript`, repo `interscript-ts`, workflow `release.yml`
+
 on:
  push:
- tags:
- - "v*"
+ tags: ['v*']
 
 permissions:
+ id-token: write
  contents: read
- id-token: write # required for npm provenance
 
 jobs:
-publish:
+release:
  runs-on: ubuntu-latest
- environment: release
  steps:
- - uses: actions/checkout@v7
- - uses: actions/setup-node@v7
+ - uses: actions/checkout@v4
+
+ - uses: actions/setup-node@v4
  with:
- node-version: "22"
- cache: npm
+ node-version: '24'
  registry-url: https://registry.npmjs.org
+
  - run: npm ci
  - run: npm run build
  - run: npm test
- - run: npm publish --provenance --access public
- env:
- NODE_AUTH_TOKEN: ${{ secrets.INTERSCRIPT_NPM_TOKEN }}
+ - run: npm publish --access public