From ad0d24a58ac91c26ba77d0dfbd1dff808e8dbde7 Mon Sep 17 00:00:00 2001
From: echoVic <137844255@qq.com>
Date: Thu, 2 Jul 2026 20:07:53 +0800
Subject: [PATCH] ci: use npm trusted publishing for releases

---
 .github/workflows/release.yml                     |  8 +++++---
 README.md                                         |  9 ++++++++-
 scripts/__tests__/semantic-release-config.test.ts | 13 +++++++++++--
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index af1dc82..01541e4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,8 +33,12 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.14'
           cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@^11.5.1
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -55,5 +59,3 @@ jobs:
         run: pnpm exec semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
diff --git a/README.md b/README.md
index ba6503d..3150883 100644
--- a/README.md
+++ b/README.md
@@ -181,7 +181,14 @@ pnpm run docs:dev
 - `BREAKING CHANGE:` 触发 major 版本
 - `docs:`、`test:`、`chore:` 等默认不会单独发包
 
-第一次启用前，需要在 GitHub 仓库的 Actions secrets 中配置 `NPM_TOKEN`，或在 npm 上为这个仓库配置 Trusted Publishing。手动预演可以运行：
+第一次启用前，需要在 npm 上为 `@blade-ai/agent-sdk` 配置 Trusted Publishing，让 GitHub Actions 通过 OIDC 发布，不再依赖长期 `NPM_TOKEN`。npm 配置项：
+
+- Owner: `echoVic`
+- Repository: `blade-agent-sdk`
+- Workflow filename: `release.yml`
+- Environment name: 留空
+
+手动预演可以运行：
 
 ```bash
 pnpm run release:dry
diff --git a/scripts/__tests__/semantic-release-config.test.ts b/scripts/__tests__/semantic-release-config.test.ts
index c0e5e77..2d8fa31 100644
--- a/scripts/__tests__/semantic-release-config.test.ts
+++ b/scripts/__tests__/semantic-release-config.test.ts
@@ -42,17 +42,21 @@ describe('release workflow', () => {
     });
   });
 
-  it('verifies the package before running semantic-release with npm auth available', () => {
+  it('verifies the package before running semantic-release with trusted publishing', () => {
     const workflow = parse(
       readFileSync(resolve('.github/workflows/release.yml'), 'utf8')
     );
     const steps = workflow.jobs.release.steps;
     const commands = steps.map((step: { run?: string }) => step.run).filter(Boolean);
+    const setupNodeStep = steps.find((step: { uses?: string }) =>
+      step.uses?.startsWith('actions/setup-node@')
+    );
     const releaseStep = steps.find((step: { run?: string }) =>
       step.run?.includes('semantic-release')
     );
 
     expect(commands).toEqual([
+      'npm install -g npm@^11.5.1',
       'pnpm install --frozen-lockfile',
       'pnpm run lint',
       'pnpm run type-check',
@@ -60,9 +64,14 @@ describe('release workflow', () => {
       'pnpm run test',
       'pnpm exec semantic-release',
     ]);
+    expect(setupNodeStep.with).toMatchObject({
+      'node-version': '22.14',
+      'registry-url': 'https://registry.npmjs.org',
+    });
     expect(releaseStep.env).toMatchObject({
       GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}',
-      NPM_TOKEN: '${{ secrets.NPM_TOKEN }}',
     });
+    expect(releaseStep.env).not.toHaveProperty('NPM_TOKEN');
+    expect(releaseStep.env).not.toHaveProperty('NPM_CONFIG_PROVENANCE');
   });
 });