From d57033b7c69f42d7056f5cb851ca249bcf89600c Mon Sep 17 00:00:00 2001
From: Sebastian Werner <s.werner@sebastian-software.de>
Date: Wed, 22 Jul 2026 22:13:43 +0200
Subject: [PATCH] ci: support npm trusted publishing recovery

---
 .github/workflows/release-please.yml | 21 ++++++++++++++++-----
 README.md                            |  2 +-
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index fb70928..e6bbce2 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -3,11 +3,19 @@ name: Release
 on:
   push:
     branches: [main]
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish the current package version to npm
+        required: true
+        default: false
+        type: boolean
 
 permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release-please:
@@ -16,6 +24,7 @@ jobs:
     steps:
       - name: Create release PR or GitHub release
         id: release
+        if: ${{ github.event_name == 'push' }}
         uses: googleapis/release-please-action@v5
         with:
           # Use a PAT to make the release PR trigger the normal pull_request CI.
@@ -24,15 +33,15 @@ jobs:
           manifest-file: .release-please-manifest.json
 
       - name: Checkout repository
-        if: ${{ steps.release.outputs.release_created }}
+        if: ${{ steps.release.outputs.release_created || (github.event_name == 'workflow_dispatch' && inputs.publish) }}
         uses: actions/checkout@v7
 
       - name: Setup pnpm
-        if: ${{ steps.release.outputs.release_created }}
+        if: ${{ steps.release.outputs.release_created || (github.event_name == 'workflow_dispatch' && inputs.publish) }}
         uses: pnpm/action-setup@v6
 
       - name: Setup Node.js 24
-        if: ${{ steps.release.outputs.release_created }}
+        if: ${{ steps.release.outputs.release_created || (github.event_name == 'workflow_dispatch' && inputs.publish) }}
         uses: actions/setup-node@v7
         with:
           node-version: 24
@@ -40,11 +49,13 @@ jobs:
           registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
-        if: ${{ steps.release.outputs.release_created }}
+        if: ${{ steps.release.outputs.release_created || (github.event_name == 'workflow_dispatch' && inputs.publish) }}
         run: pnpm install --frozen-lockfile
 
       - name: Publish package to npm
-        if: ${{ steps.release.outputs.release_created }}
+        if: ${{ steps.release.outputs.release_created || (github.event_name == 'workflow_dispatch' && inputs.publish) }}
         run: pnpm publish --no-git-checks
         env:
+          # Trusted Publishing uses the workflow's id-token permission. NPM_TOKEN
+          # remains available as a fallback for token-based npm authentication.
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/README.md b/README.md
index b98ae1b..8ff65df 100644
--- a/README.md
+++ b/README.md
@@ -133,7 +133,7 @@ pnpm test:integration  # Network/ffmpeg integration tests
 
 ### Releases
 
-Releases are automated with [Release Please](https://github.com/googleapis/release-please). Merging its release PR updates the package version and changelog, creates the GitHub release, and publishes the package to npm. The repository requires an `NPM_TOKEN` secret; a `RELEASE_PLEASE_TOKEN` secret is recommended so release PRs run the regular pull-request CI.
+Releases are automated with [Release Please](https://github.com/googleapis/release-please). Merging its release PR updates the package version and changelog, creates the GitHub release, and publishes the package to npm. The recommended setup is [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers/) for the `release-please.yml` workflow; an `NPM_TOKEN` repository secret remains supported as a fallback. A `RELEASE_PLEASE_TOKEN` secret is recommended so release PRs run the regular pull-request CI. To recover a release after configuring npm authentication, run the `Release` workflow manually with `publish` set to `true`.
 
 ### Adding a New Platform