Use npm Trusted Publisher auth in Release workflow

[Copilot]

• Confirm current workflow and branch state for the Trusted Publisher change
• Run targeted validation/tests relevant to the workflow change
• Check recent Actions runs/logs for release-related status
• Reply to the PR question with concrete test results

[Priestch]

@copilot I already setup Trusted Publisher for the github action, why still a token needed? what's the point of trusted publisher?

[Copilot]

@copilot I already setup Trusted Publisher for the github action, why still a token needed? what's the point of trusted publisher?

You’re right — with npm Trusted Publisher, a long-lived NPM_TOKEN should not be required. The point of Trusted Publisher is to use GitHub OIDC (id-token: write) to get short-lived publish credentials at runtime, so there’s no secret token to manage/rotate. I’ve updated the workflow to remove token env usage in commit eae2e2d so release publish uses the trusted publisher flow.

[Priestch]

@copilot Did you tested?

[Copilot]

@copilot Did you tested?

Yes — I tested what can be tested from this PR branch. I validated .github/workflows/release.yml syntax, ran npm ci, and ran npm run test:routes (it fails in this environment with fetch errors after dev server start, not related to the release workflow edit). I also checked the failed Release run logs: the publish failure shown there is E404 Not Found on package publish, not missing npm auth. The Trusted Publisher change itself is in eae2e2d and needs the next main release run to fully verify end-to-end publish.