Migrate npm publishing to trusted publishing (OIDC) — kill NPM_TOKEN rotation

[ElbertePlinio]

Goal: stop npm publish tokens from expiring by migrating CI publishing to npm trusted publishing (OIDC). No stored token, nothing to rotate.

Context: NPM_TOKEN expiry email received 2026-07-09. npm granular write tokens are capped at 90 days and classic tokens are revoked, so rotation emails are permanent unless we go tokenless.

PR plan

• PR 1 — pickforge-platform publish.yml → OIDC
  • Touches: .github/workflows/publish.yml (add id-token: write, drop NODE_AUTH_TOKEN)
  • Validation: next tag publish succeeds via OIDC
  • Link: pending
• PR 2 — picklab release.yml → OIDC
  • Touches: .github/workflows/release.yml (add id-token: write, drop NODE_AUTH_TOKEN, Node 20 → 24 for npm ≥ 11.5.1)
  • Validation: next picklab release publishes via OIDC
  • Link: pending

Manual steps (npmjs.com, browser — Elberte)

Configure GitHub Actions trusted publisher on each package (Settings → Trusted Publisher):

• @pickforge/auth — repo pickforge/pickforge-platform, workflow publish.yml
• @pickforge/billing — same
• @pickforge/brand — same
• @pickforge/edge-shared — same
• @pickforge/flags — same
• @pickforge/sync — same
• @pickforge/tauri-release — same
• @pickforge/picklab — repo pickforge/picklab, workflow release.yml

Cleanup

• Verify one real publish per repo via OIDC
• Delete NPM_TOKEN secret on pickforge-platform
• Delete NPM_TOKEN secret on picklab
• Revoke leftover npm tokens on npmjs.com

Ordering note: merging the PRs is safe before the npmjs.com config (publish only runs on tags), but a tag pushed after merge and before trusted-publisher config will fail to publish. Do the browser steps first.

Current status: Planned
Next action: PR 1

[ElbertePlinio]

Progress update:

• PR 1 opened: ci: publish to npm via trusted publishing (OIDC) #24 (also adds repository fields + provenance)
• PR 2 opened: ci: publish to npm via trusted publishing (OIDC) picklab#13
• Codex review loop on both
• npmjs.com trusted publisher config (8 packages) — Elberte, browser
• Verify one OIDC publish per repo, then delete both NPM_TOKEN secrets

Next: Codex reviews in flight

[ElbertePlinio]

Progress update:

• PR 1 merged: ci: publish to npm via trusted publishing (OIDC) #24 (Codex clean, CI green)
• PR 2 merged: ci: publish to npm via trusted publishing (OIDC) picklab#13 (Codex clean, CI green)
• npmjs.com trusted publisher config — in progress (picklab form filled; 7 platform packages remain)
• Verify first OIDC publish per repo
• Delete NPM_TOKEN secrets on both repos; revoke leftover tokens on npmjs.com
• Optional hardening: switch each package to "require 2FA and disallow tokens" after OIDC verified

Next: Elberte finishes trusted-publisher config in browser

[ElbertePlinio]

Progress update:

• Trusted publisher configured on npmjs.com (all 8 packages, done by Elberte)
• OIDC verified on pickforge-platform: dispatch run 29061718570 authenticated via OIDC (failed only on the expected republish-conflict for 0.6.0)
• NPM_TOKEN secret deleted on pickforge-platform
• NPM_TOKEN secret deleted on picklab
• picklab end-to-end proof on its next tagged release (config identical, low risk)
• Optional: revoke leftover tokens on npmjs.com + flip packages to 'require 2FA and disallow tokens'

Next: close after next picklab release publishes via OIDC

[ElbertePlinio]

Code slices complete: PR 1 (publish.yml OIDC) was already on pickforge-platform main (32882e7); PR 2 landed via pickforge/picklab#53 (release Node 24). Remaining items are owner-side only: configure npmjs.com trusted publishers for the 8 packages, verify one real OIDC publish per repo, then delete the NPM_TOKEN secrets and revoke leftover tokens. These are queued for the owner-acceptance phase of the release train.

[ElbertePlinio]

Status after today's v0.12.0 release (2026-07-23):

• Tag-triggered OIDC publish worked for 7/8 packages — auth, billing, brand, edge-shared, flags, sync, tauri-release all published 0.12.0 with provenance via trusted publishing, no token involved.
• @pickforge/tauri-updater (brand-new) hit the known npm limitation: trusted publishing cannot perform a package's FIRST publish (the publisher config UI only exists once the package does — Allow publishing initial version with OIDC npm/cli#8544). First publish done manually with owner 2FA; the trusted publisher (pickforge/pickforge-platform, publish.yml) was then configured, and Publishing access set to 2FA-and-disallow-tokens.
• Owner confirms NPM_TOKEN repo/org secrets are deleted and leftover tokens revoked.

Remaining before close: the next tag proves tauri-updater's OIDC path end-to-end (expected alongside the #36 enablement release). Lesson for future new packages: publish 0.0.x manually once (or via a scoped one-shot token), configure the trusted publisher, then let CI take over.