ci: migrate npm publishing to OIDC trusted publishing

.github/workflows/release-npm.yml

@@ -2,7 +2,7 @@
 #
 # Triggered by tags of the form `node-v*`. The build matrix produces the native
 # addons; the publish job ships the per-platform packages and the main package
-# with npm provenance (NPM_TOKEN).
+# with npm provenance via OIDC trusted publishing.
 name: Release (npm)
 
 on:
@@ -21,17 +21,17 @@ defaults:
 jobs:
   build:
     name: build / ${{ matrix.target }}
-    runs-on: ${{ matrix.runs-on }}
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - { os: ubuntu-latest, runs-on: blacksmith-2vcpu-ubuntu-2404, target: x86_64-unknown-linux-gnu }
-          - { os: ubuntu-latest, runs-on: blacksmith-2vcpu-ubuntu-2404, target: aarch64-unknown-linux-gnu, cross: true }
-          - { os: ubuntu-latest, runs-on: blacksmith-2vcpu-ubuntu-2404, target: x86_64-unknown-linux-musl, cross: true }
-          - { os: macos-latest, runs-on: blacksmith-6vcpu-macos-latest, target: x86_64-apple-darwin }
-          - { os: macos-latest, runs-on: blacksmith-6vcpu-macos-latest, target: aarch64-apple-darwin }
-          - { os: windows-latest, runs-on: blacksmith-2vcpu-windows-2025, target: x86_64-pc-windows-msvc }
+          - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu }
+          - { os: ubuntu-latest, target: aarch64-unknown-linux-gnu, cross: true }
+          - { os: ubuntu-latest, target: x86_64-unknown-linux-musl, cross: true }
+          - { os: macos-latest, target: x86_64-apple-darwin }
+          - { os: macos-latest, target: aarch64-apple-darwin }
+          - { os: windows-latest, target: x86_64-pc-windows-msvc }
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -71,9 +71,8 @@ jobs:
     name: publish
     needs: build
     if: startsWith(github.ref, 'refs/tags/node-v')
-    # npm provenance is only issued on GitHub-hosted runners; Blacksmith is
-    # self-hosted. The heavy build matrix stays on Blacksmith; this small
-    # publish job runs github-hosted (free on public repos) to keep provenance.
+    # Runs on a GitHub-hosted runner: npm provenance and the OIDC
+    # trusted-publishing token exchange are both only available there.
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -96,9 +95,11 @@ jobs:
       - name: Distribute artifacts into npm dirs
         run: npx napi artifacts --npm-dir npm --build-output-dir artifacts
 
+      # Trusted publishing needs npm >= 11.5.1; Node's bundled npm may be older.
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@latest
+
       - name: Publish
         run: |
           npx napi pre-publish -t npm --no-gh-release
           npm publish --access public --provenance --ignore-scripts
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

AGENTS.md

@@ -95,7 +95,7 @@ Five independent trains, each on its own tag prefix:
 
 - `v<semver>` → `release-go.yml` (GoReleaser changelog; the Go module release).
 - `rust-v<semver>` → `release-crate.yml` (crates.io).
-- `node-v<semver>` → `release-npm.yml` (npm, per-platform native addons).
+- `node-v<semver>` → `release-npm.yml` (npm, per-platform native addons; OIDC trusted publishing).
 - `py-v<semver>` → `release-pypi.yml` (PyPI wheels + sdist).
 - `dotnet-v<semver>` → `release-nuget.yml` (nuget.org, Trusted Publishing/OIDC).
   The workflow fails unless the tag's semver matches `<Version>` in