Publish to npm with trusted publishing instead of NPM_TOKEN

[MikeAlhayek]

Summary

The tag-triggered publish failed at npm whoami with E401 Unauthorized (run for tag v1.2.5), because the NPM_TOKEN secret is rejected. Switch the publish job to npm trusted publishing (OIDC) so no long-lived token is needed.

• Add permissions: id-token: write (and contents: read) to the publish job.
• Use Node 24 and make sure npm is >= 11.5.1, which trusted publishing requires.
• Drop the NODE_AUTH_TOKEN / NPM_TOKEN usage, the always-auth/scope settings, and the npm whoami pre-check (it cannot work with OIDC; the identity is only exchanged at publish time).
• The package already exists on npm, so the old "first publish of an unscoped package" guard is no longer needed.

Required setup on npmjs.com before re-running

In the @crestapps/bootstrap-select package settings, add a Trusted Publisher:

• Provider: GitHub Actions
• Organization/user: CrestApps
• Repository: bootstrap-select
• Workflow filename: publish_npm_release.yml
• Environment: leave empty (the job does not use one)

Once that is saved and this is merged, re-run the publish for the tag (or push a new tag). The NPM_TOKEN repository secret can then be deleted.

Notes

• Provenance is attached automatically; package.json already has the matching repository URL.
• The tag's workflow file is read from the tagged commit, so for v1.2.5 to use this change the tag has to be re-pointed at a commit that includes it (or publish a new tag such as v1.2.6).

Manual runs

The workflow can also be started from the Actions tab (Run workflow). Enter the version to publish (e.g. 1.2.6); it is used instead of the tag name, validated as MAJOR.MINOR.PATCH, and published from the branch selected in the dialog. Tag pushes work as before.

🤖 Generated with Claude Code