ci(security): setup trusted publishing using oidc authentication

Author: adaptive-shield-matrix

.github/workflows/publish.yml

@@ -8,18 +8,30 @@ on:
 permissions:
   id-token: write  # Required for OIDC
   contents: read
-
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
+      # Setup Bun for installation, building, and testing
       - uses: oven-sh/setup-bun@v1
         with:
           bun-version: latest
 
+      # Setup Node.js only for npm publishing with OIDC until Bun adds support for it - https://github.com/oven-sh/bun/issues/15601
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      # Use Bun for everything except publishing
       - run: bun install
       - run: bun run build
       - run: bun test
-      - run: bun publish --access public
+
+      # Ensure npm 11.5.1 or later is installed
+      - name: Update npm
+        run: npm install -g npm@latest
+      # Use npm only for publishing with OIDC support
+      - run: npm publish --access public --provenance

ops/release.sh

@@ -24,10 +24,9 @@ echo "📄 Preview of release notes:"
 echo "----------------------------------------"
 echo "$CHANGELOG_BODY"
 echo "----------------------------------------"
-echo "📦 Current version: $CURRENT_VERSION"
 
 # --- Step 2: Prompt for new version ---
-read -p "🔖 Enter new version (e.g., 0.2.1): " NEW_VERSION
+read -p "🔖 Enter new version (previous: $CURRENT_VERSION): " NEW_VERSION
 
 if [[ -z "$NEW_VERSION" ]]; then
   echo "❌ Version is required. Aborting."
@@ -66,7 +65,7 @@ TAG="v$NEW_VERSION"
 
 # --- Step 6: Git Commit and push ---
 git add "$CHANGELOG_FILE" "$PACKAGE_JSON"
-git commit -m "build(release): v$NEW_VERSION"
+git commit -m "chore(release): v$NEW_VERSION"
 git tag -a "$TAG" -m "Release v$NEW_VERSION"
 git push origin main
 git push origin --tags
@@ -80,11 +79,6 @@ gh release create "$TAG" \
   --notes-file "$CHANGELOG_FILE" \
   --repo "$REPO_NAME"
 
-# --- Step 8: Publish to npm ---
-echo "📦 Publishing to npm..."
-#bunx npm publish --access public
-bun publish --access public
-
 echo "✅ Release v$NEW_VERSION complete!"
 echo "📄 Changelog: $CHANGELOG_FILE"
 echo "🔗 GitHub: https://github.com$(echo "$REPO_URL" | sed 's/.*github.com//')/releases/tag/$TAG"