From 57b5704eb1766bfc0a9e1361e99893b55b5ad1ac Mon Sep 17 00:00:00 2001
From: Cobus Greyling <cobusgreyling@Cobuss-MacBook-Pro-2.local>
Date: Tue, 9 Jun 2026 14:17:15 +0200
Subject: [PATCH] Use npm trusted publishing (OIDC) instead of NPM_TOKEN

GitHub-linked npm accounts can publish via short-lived OIDC tokens.
Workflows now use --provenance; RELEASE.md documents trusted publisher setup.
---
 .github/workflows/release-loop-audit.yml |  9 +++++----
 .github/workflows/release-loop-init.yml  |  7 ++++---
 docs/RELEASE.md                          | 15 +++++++++++----
 3 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release-loop-audit.yml b/.github/workflows/release-loop-audit.yml
index d4e72b40..7f104255 100644
--- a/.github/workflows/release-loop-audit.yml
+++ b/.github/workflows/release-loop-audit.yml
@@ -22,6 +22,9 @@ jobs:
           cache: 'npm'
           cache-dependency-path: tools/loop-audit/package-lock.json
 
+      - name: Ensure npm supports trusted publishing (OIDC)
+        run: npm install -g npm@latest
+
       - name: Install, build, test
         working-directory: tools/loop-audit
         run: |
@@ -29,8 +32,6 @@ jobs:
           npm run build
           npm test
 
-      - name: Publish to npm
+      - name: Publish to npm (trusted publishing — no NPM_TOKEN)
         working-directory: tools/loop-audit
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
\ No newline at end of file
+        run: npm publish --access public --provenance
\ No newline at end of file
diff --git a/.github/workflows/release-loop-init.yml b/.github/workflows/release-loop-init.yml
index 3f2b6c7f..20e33a7a 100644
--- a/.github/workflows/release-loop-init.yml
+++ b/.github/workflows/release-loop-init.yml
@@ -20,11 +20,12 @@ jobs:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Ensure npm supports trusted publishing (OIDC)
+        run: npm install -g npm@latest
+
       - name: Test, build & publish
         working-directory: tools/loop-init
         run: |
           npm ci
           npm test
-          npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
\ No newline at end of file
+          npm publish --access public --provenance
\ No newline at end of file
diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index 4ef87033..5d1c7dbd 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -7,11 +7,18 @@ This repo ships two public npm packages from `tools/`:
 | `@cobusgreyling/loop-audit` | `tools/loop-audit` | `loop-audit-v*` |
 | `@cobusgreyling/loop-init` | `tools/loop-init` | `loop-init-v*` |
 
-## One-time setup
+## One-time setup (trusted publishing — recommended)
 
-1. Create an npm org/user scope `@cobusgreyling` on [npmjs.com](https://www.npmjs.com/).
-2. Generate an npm **Automation** or **Publish** token.
-3. Add it to the repo as **`NPM_TOKEN`** (Settings → Secrets → Actions).
+Link npm to GitHub, then for **each package** on [npmjs.com](https://www.npmjs.com/) → package **Settings** → **Trusted Publisher** → **GitHub Actions**:
+
+| Package | Repository | Workflow filename |
+|---------|--------------|-------------------|
+| `@cobusgreyling/loop-audit` | `cobusgreyling/loop-engineering` | `release-loop-audit.yml` |
+| `@cobusgreyling/loop-init` | `cobusgreyling/loop-engineering` | `release-loop-init.yml` |
+
+Names must match **exactly** (case-sensitive). No `NPM_TOKEN` secret is required when trusted publishing is configured.
+
+**Legacy fallback:** add an npm Automation token as repo secret `NPM_TOKEN` and restore `NODE_AUTH_TOKEN` in the publish steps.
 
 ## Version bump