ci: publish to npm via trusted publishing (OIDC) - #74

Why

The last release run failed with EINVALIDNPMTOKEN (401 on /-/whoami). The stored NPM_TOKEN was a classic token, and npm permanently revoked all classic tokens on 2025-12-09; granular write tokens also have a 90-day max lifetime. The run also showed semantic-release attempting OIDC first but failing because the workflow never granted id-token: write.

This switches publishing to npm Trusted Publishing.

Changes

• release.yml
  • add permissions: contents: write, issues: write, pull-requests: write, id-token: write
  • remove NPM_TOKEN from the release step
• release-alpha.yml
  • add contents: read + id-token: write, remove NPM_TOKEN/GITHUB_TOKEN
  • replace the disabled ::set-output syntax with $GITHUB_OUTPUT
• Delete .npmrc — it only contained //registry.npmjs.org/:_authToken=${NPM_TOKEN}, which is no longer needed and would resolve to an empty token without the secret.

⚠️ Manual steps before merging

1. On npmjs.com → package Settings → Trusted Publisher → GitHub Actions, add:
   • Organization/user: cmseguin
   • Repository: rollup-plugin-react-scoped-css
   • Workflow filename: release.yml (filename only)
   • Allowed action: npm publish — for configs created after 2026-09-03, only npm stage publish is allowed by default, so this must be selected explicitly
   • Save. npm requires a successful publish within 2 days to validate the config, or it expires.
2. If you still use alpha releases, add a second trusted publisher with workflow filename release-alpha.yml.
3. Optionally delete the now-unused NPM_TOKEN repository secret.
4. Merge this PR. Note: re-running the old failed run won't work — it uses the old workflow definition without id-token: write. The merge push will run the new workflow; semantic-release will also pick up the unreleased fix: from fix: correct docs and package metadata #72 and publish it.

Verification

• Both workflow files parse as valid YAML
• No remaining NPM_TOKEN / .npmrc references in the repo
• Node 24.x ships npm ≥ 11.5.1, satisfying the trusted-publishing requirement

Sources: npm classic tokens revoked, npm trusted publishing docs, @semantic-release/npm trusted publishing docs

🤖 Generated with Claude Code