fix: migrate to npm OIDC trusted publishing

- Remove NODE_AUTH_TOKEN dependency (tokens deprecated)
- Add npm update step for OIDC support (requires npm 11.5+)
- Update skill docs with trusted publisher setup instructions

Author: fricoben

.claude/skills/publish-cli/SKILL.md

@@ -65,7 +65,31 @@ Monitor progress at: Actions > Release CLI
 
 - **File**: `.github/workflows/release.yml`
 - **Trigger**: Push tags matching `cli-v*`
-- **Secret required**: `NPM_TOKEN` (Granular Access Token with publish permissions)
+- **Authentication**: OIDC Trusted Publishing (no tokens required)
+
+### Setting Up Trusted Publishers
+
+Each package must be configured on npmjs.com to trust this workflow:
+
+1. Go to `https://www.npmjs.com/package/<package-name>/access`
+2. Scroll to **"Trusted Publisher"** section
+3. Click **"GitHub Actions"**
+4. Configure:
+   - **Organization/User**: `lfglabs-dev`
+   - **Repository**: `louisville`
+   - **Workflow filename**: `release.yml`
+   - **Environment**: *(leave blank)*
+
+Packages requiring trusted publisher setup:
+- `vibetracking`
+- `@starknetid/vibetracking-core`
+- `@starknetid/vibetracking-core-darwin-x64`
+- `@starknetid/vibetracking-core-darwin-arm64`
+- `@starknetid/vibetracking-core-darwin-universal`
+- `@starknetid/vibetracking-core-linux-x64-gnu`
+- `@starknetid/vibetracking-core-linux-arm64-gnu`
+- `@starknetid/vibetracking-core-win32-x64-msvc`
+- `@starknetid/vibetracking-core-win32-arm64-msvc`
 
 ## Manual Trigger (Dry Run)
 

.github/workflows/release.yml

@@ -181,36 +181,33 @@ jobs:
         run: ls -la npm/ || echo "No npm directory"
         working-directory: packages/core
 
+      - name: Update npm (required for OIDC)
+        run: npm install -g npm@latest
+
       - name: Publish platform packages
         if: ${{ github.event.inputs.dry_run != 'true' }}
         run: |
           for dir in npm/*/; do
             if [ -d "$dir" ]; then
               echo "Publishing $dir"
-              (cd "$dir" && npm publish --access public --provenance)
+              (cd "$dir" && npm publish --access public)
             fi
           done
         working-directory: packages/core
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish @starknetid/vibetracking-core
         if: ${{ github.event.inputs.dry_run != 'true' }}
-        run: npm publish --access public --provenance
+        run: npm publish --access public
         working-directory: packages/core
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Build CLI
         run: bun run build
         working-directory: packages/cli
 
       - name: Publish vibetracking CLI
         if: ${{ github.event.inputs.dry_run != 'true' }}
-        run: npm publish --access public --provenance
+        run: npm publish --access public
         working-directory: packages/cli
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Summary
         run: |