From 18eb4b95d5e741ac334feab14147c5814ae98e8f Mon Sep 17 00:00:00 2001
From: contra <vytautas@civilis.lt>
Date: Wed, 12 Aug 2026 13:43:34 +0300
Subject: [PATCH] feat: switch npm publish to OIDC trusted publishing, rename
 release-gate

Replace NPM_TOKEN with OIDC trusted publishing (id-token: write).
Node bumped to 24 (trusted publishing requires 22.14+).
Renamed gate job to release-gate to avoid blocking PR merges.

Signed-off-by: contra <vytautas@civilis.lt>
---
 .github/workflows/release.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a3d5793..c7c93e2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,7 +8,7 @@ permissions:
   id-token: write
 
 jobs:
-  gate:
+  release-gate:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -20,7 +20,7 @@ jobs:
       - run: make audit-public
 
   goreleaser:
-    needs: gate
+    needs: release-gate
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -40,11 +40,14 @@ jobs:
   npm-publish:
     needs: goreleaser
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # OIDC for npm trusted publishing
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
 
       - name: Download release binaries
@@ -79,5 +82,3 @@ jobs:
           cd npm/shellroute
           jq --arg v "$VERSION" '.optionalDependencies |= with_entries(.value = $v)' package.json > tmp.json && mv tmp.json package.json
           npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}