Publish npm via OIDC trusted publishing

[MikeAlhayek]

Problem

The npm preview publish workflow was failing:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@crestapps%2fai-chat-ui - Not found
npm error 404  '@crestapps/ai-chat-ui@2.0.0-preview.180' is not in this registry.

The build and packaging succeed — this is the upload being rejected. For scoped packages npm deliberately returns 404 on PUT when the request isn't authorized (it masks 401/403 to avoid leaking existence). The package exists and published fine through 2.0.0-preview.175 on 2026-09-11; the two failing runs on 2026-09-14 were manual workflow_dispatch runs — the first time auth was exercised since. In short: the NPM_TOKEN secret expired/was revoked.

Fix

Rather than rotate another expiring token, switch to npm OIDC trusted publishing (short-lived per-run token, scoped to this repo + workflow, nothing to leak or expire).

Because npm allows only one trusted publisher per package, the two publish workflows are merged into a single publish_npm.yml:

Trigger	Action	dist-tag
workflow_dispatch	preview publish (unconditional)	preview
schedule (daily)	preview publish only when assets changed	preview
push tag v*.*.*	release publish	latest

Changes:

• Add id-token: write permission for OIDC.
• Upgrade the runner npm to >= 11.5.1 (npm install -g npm@latest; Node 20 ships npm 10.x, which predates trusted publishing).
• Remove NODE_AUTH_TOKEN / NPM_TOKEN entirely.
• Delete publish_npm_preview.yml and publish_npm_release.yml.
• Preview asset-change detection and run-number versioning are preserved; the run-history API call now targets publish_npm.yml, and tag/release runs are excluded from that check by the branch=main filter.

Required manual setup (done on npmjs.com)

Trusted publisher configured on @crestapps/ai-chat-ui: GitHub Actions provider, org CrestApps, repo CrestApps.Core, workflow filename publish_npm.yml, no environment, "Allow npm publish" enabled (required for unattended publishing).

Verification

OIDC can only be validated from main. After merge, trigger publish_npm.yml via workflow_dispatch to confirm the first token-free publish succeeds. The now-unused NPM_TOKEN repo secret can then be deleted.

🤖 Generated with Claude Code