ci(publish): use OIDC trusted publishing only (#42)

The maintainer is using GitHub OIDC trusted publishing, so drop the
NPM_TOKEN fallback added in the prior PR — the publish job now matches
chant's clean pure-OIDC step (id-token: write, no registry-url, npm
publish --provenance, idempotent). README Releasing section updated.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: lex00

.github/workflows/publish.yml

@@ -34,14 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write # OIDC trusted publishing (preferred; no secret needed)
-    env:
-      # Optional fallback for the FIRST publish: OIDC trusted publishing only
-      # works once the package exists + a trusted-publisher record is configured
-      # on npm. Before that, set an NPM_TOKEN repo/org secret and the workflow
-      # publishes with it. Once trusted publishing is set up, drop the secret
-      # and it falls through to OIDC automatically.
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      id-token: write # OIDC trusted publishing — no NPM_TOKEN secret needed
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -51,23 +44,13 @@ jobs:
           # Deliberately NOT setting registry-url: that flag makes setup-node
           # write an .npmrc with `_authToken=${NODE_AUTH_TOKEN}`, and the token
           # defaults to a literal placeholder when unset — which the registry
-          # 404s on instead of falling through to OIDC. We write .npmrc
-          # ourselves below only when a token is actually present.
+          # 404s on instead of falling through to OIDC. Without registry-url
+          # there is no .npmrc; `npm publish` detects the OIDC id-token
+          # environment and exchanges it for a short-lived publish token via the
+          # package's trusted-publisher record.
       - run: npm ci
       - name: Publish github-warden
         run: |
-          set -euo pipefail
           V=$(node -e "process.stdout.write(require('./package.json').version)")
           P=$(npm view github-warden version 2>/dev/null || echo "none")
-          if [ "$V" = "$P" ]; then
-            echo "github-warden@$V already published, skipping"
-            exit 0
-          fi
-          if [ -n "${NPM_TOKEN:-}" ]; then
-            echo "Publishing $V with NPM_TOKEN"
-            echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-            npm publish --access public --provenance
-          else
-            echo "Publishing $V via OIDC trusted publishing"
-            npm publish --access public --provenance
-          fi
+          [ "$V" = "$P" ] && echo "github-warden@$V already published, skipping" || npm publish --access public --provenance

README.md

@@ -242,13 +242,10 @@ main) on a schedule, pinned to a warden Action SHA.
 and pushes — which triggers `.github/workflows/publish.yml` (test gate → `npm
 publish --provenance`).
 
-npm auth is one of two modes (the workflow supports both):
-
-- **OIDC trusted publishing** (preferred, no secret) — requires a one-time
-  trusted-publisher record on npm for `github-warden` ← `intentius/github-warden`
-  `publish.yml`. Works only after the package's first publish exists.
-- **`NPM_TOKEN` secret** (fallback) — set a repo/org `NPM_TOKEN` secret for the
-  first publish; drop it once trusted publishing is configured.
+Publishing uses **GitHub OIDC trusted publishing** — no `NPM_TOKEN` secret. It
+requires a one-time trusted-publisher record on npm for `github-warden` ←
+`intentius/github-warden`'s `publish.yml` (the workflow already requests
+`id-token: write` and publishes with `--provenance`).
 
 ## Architecture