fix(ci): scrub npm token before trusted publish

Author: PatrickJS

.github/workflows/release.yml

@@ -88,7 +88,9 @@ jobs:
 
       - name: Publish to npm
         if: ${{ steps.release.outputs.release_created == 'true' && steps.npm_version.outputs.published != 'true' }}
-        run: npm publish --access public "${{ steps.pack.outputs.tarball }}"
+        run: |
+          unset NODE_AUTH_TOKEN
+          npm publish --access public "${{ steps.pack.outputs.tarball }}"
 
       - name: Attach package tarball to GitHub Release
         if: ${{ steps.release.outputs.release_created == 'true' }}
@@ -153,7 +155,9 @@ jobs:
 
       - name: Publish to npm
         if: ${{ steps.npm_version.outputs.published != 'true' }}
-        run: npm publish --access public "${{ steps.pack.outputs.tarball }}"
+        run: |
+          unset NODE_AUTH_TOKEN
+          npm publish --access public "${{ steps.pack.outputs.tarball }}"
 
       - name: Ensure GitHub Release exists
         env:

docs/ci-and-release.md

@@ -151,10 +151,11 @@ Keep the package public through `publishConfig.access: "public"` and the workflo
 npm publish --access public
 ```
 
-The publish steps intentionally do not define `NODE_AUTH_TOKEN`; npm Trusted
-Publishing should use the GitHub OIDC identity directly. Keep `package.json`
-`repository.url` exactly aligned with `https://github.com/async-framework/async-db`,
-because npm validates trusted publishing against the GitHub repository identity.
+The publish steps intentionally unset any inherited `NODE_AUTH_TOKEN`; npm
+Trusted Publishing should use the GitHub OIDC identity directly. Keep
+`package.json` `repository.url` exactly aligned with
+`https://github.com/async-framework/async-db`, because npm validates trusted
+publishing against the GitHub repository identity.
 
 If Trusted Publishing is not configured yet, the release workflow can create the release PR and GitHub release, but npm publish will fail until npm trusts this repository and workflow.
 

test/package/exports.test.ts

@@ -373,7 +373,8 @@ test('release automation creates release PRs and publishes npm from pinned actio
   assert.match(workflow, /actions\/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6\.0\.2/);
   assert.match(workflow, /actions\/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6/);
   assert.match(workflow, /id-token: write/);
-  assert.doesNotMatch(workflow, /NODE_AUTH_TOKEN/);
+  assert.match(workflow, /unset NODE_AUTH_TOKEN/);
+  assert.doesNotMatch(workflow, /NODE_AUTH_TOKEN:/);
   assert.match(workflow, /npm publish --access public/);
   assert.match(workflow, /npm run release:check/);
   assert.deepEqual(releaseConfig.packages['.'], {