chore(ci): use NPM trusted publishing

.github/workflows/publish-npm.yml

@@ -16,14 +16,19 @@ jobs:
     # staging repo must never reach npm.
     if: github.repository == 'browserbase/sdk-node'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
-          node-version: '20'
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
 
       - name: Install dependencies
         run: |
@@ -32,5 +37,3 @@ jobs:
       - name: Publish to NPM
         run: |
           bash ./bin/publish-npm
-        env:
-          NPM_TOKEN: ${{ secrets.BROWSERBASE_NPM_TOKEN || secrets.NPM_TOKEN }}

.github/workflows/release-doctor.yml

@@ -20,5 +20,3 @@ jobs:
         env:
           STLC_BOT_APP_ID: ${{ secrets.STLC_BOT_APP_ID }}
           STLC_BOT_PRIVATE_KEY: ${{ secrets.STLC_BOT_PRIVATE_KEY }}
-          NPM_TOKEN: ${{ secrets.BROWSERBASE_NPM_TOKEN || secrets.NPM_TOKEN }}
-

CONTRIBUTING.md

@@ -99,9 +99,10 @@ the changes aren't made through the automated pipeline, you may want to make rel
 
 ### Publish with a GitHub workflow
 
-You can release to package managers by using [the `Publish NPM` GitHub action](https://www.github.com/browserbase/sdk-node/actions/workflows/publish-npm.yml). This requires a setup organization or repository secret to be set up.
+You can release to npm by using [the `Publish NPM` GitHub action](https://www.github.com/browserbase/sdk-node/actions/workflows/publish-npm.yml). The workflow authenticates to npm through trusted publishing with GitHub Actions OIDC; it doesn't require an npm token secret.
+
+The `@browserbasehq/sdk` package's trusted publisher must authorize the `browserbase/sdk-node` repository and the `publish-npm.yml` workflow.
 
 ### Publish manually
 
-If you need to manually release a package, you can run the `bin/publish-npm` script with an `NPM_TOKEN` set on
-the environment.
+If you need to release a package outside GitHub Actions, authenticate the npm CLI locally and run the `bin/publish-npm` script.

bin/check-release-environment

@@ -8,10 +8,6 @@ if [ -z "${STLC_BOT_APP_ID}" ] || [ -z "${STLC_BOT_PRIVATE_KEY}" ]; then
   errors+=("The STLC_BOT_APP_ID / STLC_BOT_PRIVATE_KEY secrets are not set. Releases mint tokens from the browserbase-stlc-bot GitHub App; check the org secrets' repository access.")
 fi
 
-if [ -z "${NPM_TOKEN}" ]; then
-  errors+=("The NPM_TOKEN secret has not been set. Please set it in either this repository's secrets or your organization secrets")
-fi
-
 lenErrors=${#errors[@]}
 
 if [[ lenErrors -gt 0 ]]; then
@@ -25,4 +21,3 @@ if [[ lenErrors -gt 0 ]]; then
 fi
 
 echo "The environment is ready to push releases!"
-

bin/publish-npm

@@ -2,8 +2,6 @@
 
 set -eux
 
-npm config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
-
 yarn build
 cd dist