ci(publish): publish via npm trusted publishing instead of NPM_TOKEN

.github/workflows/publish.yml

@@ -3,25 +3,32 @@ name: Publish
 # Publishes to npm on every push to main, but only when package.json's version is one that
 # is not yet on the registry — so a commit that bumps the version releases it, and any other
 # commit is a harmless no-op. Bump with `npm version patch|minor|major` and push.
+#
+# Authenticates with npm trusted publishing (OIDC): npm trades this job's GitHub identity token
+# for a short-lived publish credential, so there is no NPM_TOKEN secret to store or expire. It
+# needs the trusted publisher configured on npmjs.com (lonetis/claudeleaf, publish.yml), npm
+# >= 11.5.1 (bundled with Node 24), and package.json's repository.url matching this repo, since
+# npm also attaches a provenance attestation.
 on:
   push:
     branches: [main]
   workflow_dispatch:
 
 permissions:
   contents: read
+  id-token: write # OIDC token for npm trusted publishing
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
+      # No dependency cache: a release build installs fresh from the lockfile.
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
-          cache: npm
 
       - run: npm ci
       - run: npm run build
@@ -37,5 +44,3 @@ jobs:
             echo "Publishing $NAME@$VERSION…"
             npm publish --access public
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CLAUDE.md

@@ -306,8 +306,12 @@ MCP server with `npx -y claudeleaf mcp`) without cloning. What makes that work:
 - `.github/workflows/publish.yml` — on push to `main` (or manual dispatch) it runs
   `npm ci && npm run build && npm test`, then publishes **only if `package.json`'s version is
   not already on the registry**. So a commit that bumps the version (`npm version patch`)
-  releases it; any other commit is a no-op. Needs an `NPM_TOKEN` repo secret (an npm automation
-  token with publish rights); `actions/setup-node` wires it in via `NODE_AUTH_TOKEN`.
+  releases it; any other commit is a no-op. It authenticates with **npm trusted publishing**
+  (OIDC) — no `NPM_TOKEN` secret: the job's `id-token: write` permission lets npm trade the
+  GitHub identity token for a short-lived publish credential. This needs the trusted publisher
+  configured on npmjs.com (repo `lonetis/claudeleaf`, workflow `publish.yml`), npm ≥ 11.5.1
+  (hence Node 24 in that job), and `package.json`'s `repository.url` matching the GitHub repo —
+  npm attaches a provenance attestation and rejects the publish on a mismatch.
 - `.github/workflows/ci.yml` — typecheck + build + test on PRs and non-`main` pushes.
 - In CI the live integration/MCP tests auto-skip (no cached session → no network), so `npm test`
   runs the unit suite only.

package.json

@@ -5,6 +5,10 @@
   "type": "module",
   "license": "MIT",
   "author": "Louis Jannett",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lonetis/claudeleaf.git"
+  },
   "keywords": [
     "overleaf",
     "latex",