From 067ef7ec4f958f7800676e7a4c8124c1fbdbdbb0 Mon Sep 17 00:00:00 2001
From: Caian Ertl <hi@caian.org>
Date: Fri, 17 Jul 2026 15:19:22 -0300
Subject: [PATCH 1/2] ci(release-npm): publish to npm via OIDC trusted
 publishing

Drop the long-lived NPM_TOKEN: remove NODE_AUTH_TOKEN from the publish
step and rely on npm OIDC trusted publishing (npm upgraded to >= 11.5.1
in-job). Move the build matrix and publish job to GitHub-hosted runners,
required for both the OIDC token exchange and provenance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release-npm.yml | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
index 6853035..9da4342 100644
--- a/.github/workflows/release-npm.yml
+++ b/.github/workflows/release-npm.yml
@@ -2,7 +2,7 @@
 #
 # Triggered by tags of the form `node-v*`. The build matrix produces the native
 # addons; the publish job ships the per-platform packages and the main package
-# with npm provenance (NPM_TOKEN).
+# with npm provenance via OIDC trusted publishing.
 name: Release (npm)
 
 on:
@@ -21,17 +21,17 @@ defaults:
 jobs:
   build:
     name: build / ${{ matrix.target }}
-    runs-on: ${{ matrix.runs-on }}
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - { os: ubuntu-latest, runs-on: blacksmith-2vcpu-ubuntu-2404, target: x86_64-unknown-linux-gnu }
-          - { os: ubuntu-latest, runs-on: blacksmith-2vcpu-ubuntu-2404, target: aarch64-unknown-linux-gnu, cross: true }
-          - { os: ubuntu-latest, runs-on: blacksmith-2vcpu-ubuntu-2404, target: x86_64-unknown-linux-musl, cross: true }
-          - { os: macos-latest, runs-on: blacksmith-6vcpu-macos-latest, target: x86_64-apple-darwin }
-          - { os: macos-latest, runs-on: blacksmith-6vcpu-macos-latest, target: aarch64-apple-darwin }
-          - { os: windows-latest, runs-on: blacksmith-2vcpu-windows-2025, target: x86_64-pc-windows-msvc }
+          - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu }
+          - { os: ubuntu-latest, target: aarch64-unknown-linux-gnu, cross: true }
+          - { os: ubuntu-latest, target: x86_64-unknown-linux-musl, cross: true }
+          - { os: macos-latest, target: x86_64-apple-darwin }
+          - { os: macos-latest, target: aarch64-apple-darwin }
+          - { os: windows-latest, target: x86_64-pc-windows-msvc }
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -71,9 +71,8 @@ jobs:
     name: publish
     needs: build
     if: startsWith(github.ref, 'refs/tags/node-v')
-    # npm provenance is only issued on GitHub-hosted runners; Blacksmith is
-    # self-hosted. The heavy build matrix stays on Blacksmith; this small
-    # publish job runs github-hosted (free on public repos) to keep provenance.
+    # Runs on a GitHub-hosted runner: npm provenance and the OIDC
+    # trusted-publishing token exchange are both only available there.
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -96,9 +95,11 @@ jobs:
       - name: Distribute artifacts into npm dirs
         run: npx napi artifacts --npm-dir npm --build-output-dir artifacts
 
+      # Trusted publishing needs npm >= 11.5.1; Node's bundled npm may be older.
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@latest
+
       - name: Publish
         run: |
           npx napi pre-publish -t npm --no-gh-release
           npm publish --access public --provenance --ignore-scripts
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From 859590151897dacbf7d0e7787613ab6c00d4c5cb Mon Sep 17 00:00:00 2001
From: Caian Ertl <hi@caian.org>
Date: Fri, 17 Jul 2026 15:22:02 -0300
Subject: [PATCH 2/2] docs(release): note OIDC trusted publishing on the npm
 release train

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 51cac3f..225eb66 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -95,7 +95,7 @@ Five independent trains, each on its own tag prefix:
 
 - `v<semver>` → `release-go.yml` (GoReleaser changelog; the Go module release).
 - `rust-v<semver>` → `release-crate.yml` (crates.io).
-- `node-v<semver>` → `release-npm.yml` (npm, per-platform native addons).
+- `node-v<semver>` → `release-npm.yml` (npm, per-platform native addons; OIDC trusted publishing).
 - `py-v<semver>` → `release-pypi.yml` (PyPI wheels + sdist).
 - `dotnet-v<semver>` → `release-nuget.yml` (nuget.org, Trusted Publishing/OIDC).
   The workflow fails unless the tag's semver matches `<Version>` in