chore(release): 0.2.14 - publish through npm trusted publishing (#8)

Author: PerryLink

.github/workflows/release.yml

@@ -20,9 +20,12 @@ jobs:
       - uses: actions/setup-node@v5
         with:
           node-version: 22
-          registry-url: 'https://registry.npmjs.org'
           cache: pnpm
-
+          # No `registry-url` on purpose: it writes
+          # `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` into a local
+          # .npmrc, and with the secret retired that line is an EMPTY bearer token -
+          # the registry then answers 404 on PUT instead of letting npm perform the
+          # OIDC trusted-publishing exchange.
       - name: Install
         run: pnpm install --frozen-lockfile
 
@@ -43,16 +46,25 @@ jobs:
       # npm publish runs with provenance when NPM_TOKEN is present. A tag
       # push without the secret, or for a version already on the registry,
       # skips the publish instead of failing the release tag.
+      # Trusted publishing: the OIDC token (id-token: write above) replaces the
+      # long-lived NPM_TOKEN, so this step reads no secret. The previous version
+      # also skipped the publish when NPM_TOKEN was empty - that guard is gone on
+      # purpose, or retiring the secret would have turned this into a silent no-op.
+      - name: Upgrade npm and show what the publish will authenticate with
+        run: |
+          npm install -g npm@^11.5.1
+          echo "npm: $(npm --version)"
+          echo "registry: $(npm config get registry)"
+          if [ -f .npmrc ]; then echo "--- workspace .npmrc ---"; cat .npmrc; else echo "no workspace .npmrc"; fi
+          if [ -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]; then echo "OIDC request TOKEN: present"; else echo "OIDC request TOKEN: MISSING"; fi
+
       - name: Publish to npm
         env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # npm's OIDC exchange never throws: a failure is only visible at verbose
+          # level, otherwise the step just fails with ENEEDAUTH and no reason.
+          NPM_CONFIG_LOGLEVEL: verbose
         run: |
           version="$(node -p "require('./package.json').version")"
-          if [ -z "$NPM_TOKEN" ]; then
-            echo "NPM_TOKEN secret is not set; skipping npm publish"
-            exit 0
-          fi
           if npm view "dsh-fast@${version}" version >/dev/null 2>&1; then
             echo "dsh-fast@${version} is already published; skipping npm publish"
           else

CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.14] - 2026-09-19
+
+### Added
+
+- `pnpm run check:lockfile` (`scripts/check-lockfile-drift.mjs`) fails fast when `package.json` and `pnpm-lock.yaml` disagree; the probe is read-only and the documented checks chain runs it alongside the other gates.
+
+### Changed
+
+- The release workflow now publishes through **npm trusted publishing** (OIDC) instead of the long-lived `NPM_TOKEN` secret: `setup-node` no longer sets `registry-url` (its empty `_authToken` line made the registry answer 404 on PUT), npm is upgraded to >= 11.5.1 before publishing, and the "NPM_TOKEN is not set -> skip" guard is gone so a missing publisher cannot turn a release into a silent no-op.
 ## [0.2.13] - 2026-09-18
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-fast",
-  "version": "0.2.13",
+  "version": "0.2.14",
   "description": "Read-only performance diagnostics for DeepSeek Harness: session load (open/restore) timing, spill-hit counts, compaction count and trigger, context-injection volume (AGENTS.md/skills/tool-schema token share), and LLM cache hit rate — surfaced via the /fast command and the fast_report tool, persisted as reconstructable fast/* session events with async sampling off the model path.",
   "author": "dsh-fast contributors",
   "repository": {

src/version.ts

@@ -1,2 +1,2 @@
 /** Single-source plugin version, bumped by `scripts/release.mjs`. @module dsh-fast/version */
-export const VERSION = '0.2.13'
+export const VERSION = '0.2.14'