ci: use npm trusted publishing for releases

.github/workflows/release.yml

@@ -33,8 +33,12 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.14'
           cache: 'pnpm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@^11.5.1
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -55,5 +59,3 @@ jobs:
         run: pnpm exec semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true

README.md

@@ -181,7 +181,14 @@ pnpm run docs:dev
 - `BREAKING CHANGE:` 触发 major 版本
 - `docs:`、`test:`、`chore:` 等默认不会单独发包
 
-第一次启用前，需要在 GitHub 仓库的 Actions secrets 中配置 `NPM_TOKEN`，或在 npm 上为这个仓库配置 Trusted Publishing。手动预演可以运行：
+第一次启用前，需要在 npm 上为 `@blade-ai/agent-sdk` 配置 Trusted Publishing，让 GitHub Actions 通过 OIDC 发布，不再依赖长期 `NPM_TOKEN`。npm 配置项：
+
+- Owner: `echoVic`
+- Repository: `blade-agent-sdk`
+- Workflow filename: `release.yml`
+- Environment name: 留空
+
+手动预演可以运行：
 
 ```bash
 pnpm run release:dry

scripts/__tests__/semantic-release-config.test.ts

@@ -42,27 +42,36 @@ describe('release workflow', () => {
     });
   });
 
-  it('verifies the package before running semantic-release with npm auth available', () => {
+  it('verifies the package before running semantic-release with trusted publishing', () => {
     const workflow = parse(
       readFileSync(resolve('.github/workflows/release.yml'), 'utf8')
     );
     const steps = workflow.jobs.release.steps;
     const commands = steps.map((step: { run?: string }) => step.run).filter(Boolean);
+    const setupNodeStep = steps.find((step: { uses?: string }) =>
+      step.uses?.startsWith('actions/setup-node@')
+    );
     const releaseStep = steps.find((step: { run?: string }) =>
       step.run?.includes('semantic-release')
     );
 
     expect(commands).toEqual([
+      'npm install -g npm@^11.5.1',
       'pnpm install --frozen-lockfile',
       'pnpm run lint',
       'pnpm run type-check',
       'pnpm run build',
       'pnpm run test',
       'pnpm exec semantic-release',
     ]);
+    expect(setupNodeStep.with).toMatchObject({
+      'node-version': '22.14',
+      'registry-url': 'https://registry.npmjs.org',
+    });
     expect(releaseStep.env).toMatchObject({
       GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}',
-      NPM_TOKEN: '${{ secrets.NPM_TOKEN }}',
     });
+    expect(releaseStep.env).not.toHaveProperty('NPM_TOKEN');
+    expect(releaseStep.env).not.toHaveProperty('NPM_CONFIG_PROVENANCE');
   });
 });