Migrate from npm token to open id connect (#1248)

Author: sarah-inkeep

.changeset/clever-hornets-notice.md

@@ -0,0 +1,13 @@
+---
+"@inkeep/agents-cli": patch
+"@inkeep/agents-manage-api": patch
+"@inkeep/agents-manage-ui": patch
+"@inkeep/agents-run-api": patch
+"@inkeep/agents-core": patch
+"@inkeep/agents-manage-mcp": patch
+"@inkeep/agents-sdk": patch
+"@inkeep/ai-sdk-provider": patch
+"@inkeep/create-agents": patch
+---
+
+Update to open id connect for release action

.github/workflows/release.yml

@@ -17,6 +17,7 @@ permissions:
   pull-requests: write
   issues: write
   packages: write
+  id-token: write
 
 jobs:
   release:
@@ -28,17 +29,18 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Configure npm and verify auth
-        run: |
-          npm config set //registry.npmjs.org/:_authToken=$NODE_AUTH_TOKEN
-          echo "Verifying npm authentication..."
-          npm whoami
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Install
         uses: ./.github/composite-actions/install
 
+      - name: Setup npm for OIDC publishing
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Ensure npm 11.5.1+ for OIDC support
+        run: npm install -g npm@latest
+
       - name: Setup Turborepo cache
         uses: actions/cache@v4
         with:
@@ -60,7 +62,6 @@ jobs:
         with:
           publish: pnpm release
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HUSKY: 0
 
@@ -78,6 +79,5 @@ jobs:
           pnpm changeset version --snapshot $TAG_NAME
           pnpm changeset publish --tag $TAG_NAME
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HUSKY: 0