From f3e7a35f0ce41392c02385e7117527124dfe143c Mon Sep 17 00:00:00 2001
From: martyy-code <nesalia.inc@gmail.com>
Date: Mon, 3 Aug 2026 14:07:22 +0200
Subject: [PATCH] fix(release): unblock npm trusted publishing (Node 24 +
 provenance flags)

PR #45 fixed the missing version-bump commit but ENEEDAUTH persisted
on the publish step. Trust on npmjs.com was tightened (no environment
filter), but the workflow was still not signaling OIDC intent to pnpm.

Three aligned changes, mirroring the proven pattern in our other
release workflows:

1. Release workflow: node-version 22 -> 24. The runner already defaults
   to Node 24; pinning 22 was unnecessarily old and predates the npm
   CLI >= 11.5.1 + Node >= 22.14.0 trusted-publishing prerequisites.
2. 'Publish packages' step: add env NPM_CONFIG_PROVENANCE: 'true'.
   pnpm reads this and routes publish through OIDC, not the legacy
   fallback path that requires a token.
3. packages/errors/package.json: add publishConfig.provenance: true.
   Belt + suspenders alongside the env var, and gives npm a default
   intent for provenance attestation on every publish.

Adds a changeset to pass the new ci.yml lint.
---
 .changeset/fix-oidc-publish.md | 9 +++++++++
 .github/workflows/release.yml  | 4 +++-
 packages/errors/package.json   | 4 ++++
 3 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/fix-oidc-publish.md

diff --git a/.changeset/fix-oidc-publish.md b/.changeset/fix-oidc-publish.md
new file mode 100644
index 0000000..be46f27
--- /dev/null
+++ b/.changeset/fix-oidc-publish.md
@@ -0,0 +1,9 @@
+---
+"@deessejs/errors": patch
+---
+
+Fix npm trusted publishing (OIDC) end-to-end. Three changes:
+
+1. Release workflow bumps Node 22 → 24 (the runner default; matches our other release workflows, and aligns with npm CLI ≥ 11.5.1 + Node ≥ 22.14.0 requirements for trusted publishing).
+2. `Publish packages` step now passes `env: NPM_CONFIG_PROVENANCE: 'true'`, which forces pnpm publish down the OIDC code path instead of falling back to a token.
+3. `packages/errors/package.json` now declares `publishConfig.provenance: true`, so npm always emits a provenance attestation on publish (belt + suspenders alongside the env var).
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1d052dd..2999319 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -88,6 +88,8 @@ jobs:
 
       - name: Publish packages
         if: steps.detect.outputs.has_changesets == 'true' && (github.event_name == 'workflow_dispatch' || inputs.dry_run != true)
+        env:
+          NPM_CONFIG_PROVENANCE: 'true'
         run: |
           if [ -n "${{ inputs.packages }}" ]; then
             pnpm changeset publish --packages=$(echo "${{ inputs.packages }}" | tr ',' ' ')
diff --git a/packages/errors/package.json b/packages/errors/package.json
index c03e491..c2db56b 100644
--- a/packages/errors/package.json
+++ b/packages/errors/package.json
@@ -34,6 +34,10 @@
   ],
   "author": "Nesalia Inc. <hello@nesalia.com>",
   "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "devDependencies": {
     "@eslint/js": "^9.0.0",
     "@types/node": "^25.9.1",