Adopt npm staged publishing for @getmunin/* releases (when pnpm/changesets supports it)

[kmonsoe]

Background

GitHub announced staged publishing for npm (GA 2026-05-22). Packages are uploaded to a queue and require explicit human approval (with 2FA) before becoming installable. Paired with OIDC trusted publishing in "stage-only" mode, it blocks direct publishes and only accepts staged uploads from CI — meaning a compromised NPM_TOKEN alone can't ship a malicious version of an @getmunin/* package.

Why we should care

We publish ~13 public @getmunin/* packages from CI via pnpm changeset publish (see package.json release script). A compromised CI token is currently a single point of failure for our supply chain. Staged publishing closes that gap by requiring a human 2FA approval to promote any release.

Blocker

The feature is invoked via npm stage publish (npm 11.15.0+). Our release path uses pnpm + @changesets/cli, neither of which currently supports staged publishing. We can't adopt it without going off-tool.

Action

• Watch pnpm and @changesets/cli for staged-publishing support
• When supported: switch CI to staged publishes and configure OIDC trusted publishing in "stage-only" mode
• Document the approval flow (who approves, how)

Not adopting

The companion --allow-file / --allow-remote / --allow-directory install-source flags are npm-CLI only and don't apply to our pnpm workflow.

References

• https://github.blog/changelog/2026-05-22-staged-publishing-and-new-install-time-controls-for-npm/