[snhsish]

Why

The NPM_TOKEN (granular) publish failed with E404 on PUT (see failed Version run after #150). Switch to npm Trusted Publishing (OIDC) so no long-lived token is needed.

Workflow changes (version.yml)

• permissions: add id-token: write (mandatory for GitHub OIDC minting).
• pnpm/action-setup: use pnpm 10 (repo still pins pnpm 9 for development). Reason: changesets shells out to pnpm publish, and OIDC trusted-publishing support exists in pnpm 10+, not in 9.15. Lockfile format is unchanged (v9.0), so frozen install is unaffected.
• Removed NPM_TOKEN env. GITHUB_TOKEN stays.

Node stays 20: the OIDC exchange is done by pnpm itself, so npm CLI's Node>=22.14 requirement does not apply. pnpm auto-attaches provenance for this public package + public repo.

Required companion step (npmjs.com, cannot be done in code)

On the crosscode package -> Settings -> Trusted Publisher -> GitHub Actions, create the record with exactly:

• Organization or user: snhsish
• Repository: crosscode
• Workflow filename: version.yml
• Environment name: (empty)
• Label: e.g. crosscode release (optional)
• Allowed actions: enable direct publish (changesets publishes directly, not staged) and dist-tag management (changesets sets latest)

These values are immutable once created; a typo means delete + recreate.

Rollout

1. Create the npm trusted-publisher record FIRST.
2. Merge this PR. The merge commit triggers the Version workflow on main, which will detect local 0.9.0 unpublished and publish it via OIDC.
3. If the merge-triggered run fires before the npm record exists, it fails with 403 - just re-run failed jobs after creating the record.
4. After the first green OIDC publish, delete the NPM_TOKEN repo secret - it is no longer referenced and should not exist.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
crosscode-web	Ready	Preview	Oct 19, 2026 5:26am UTC