ci: publish alpha releases via npm trusted publishing (OIDC)

Make release_alpha.yml self-contained (no longer calls npm_release.yml) and
move npm auth from a long-lived NPM_TOKEN to OIDC trusted publishing with
provenance. Node 22 + npm 11.5.1 via corepack meet the Trusted Publishing
minimums. The version bump commit/tag are still pushed with the PAT secret.

beta/latest continue to use npm_release.yml + NPM_TOKEN and are unaffected.

Requires a one-time Trusted Publisher registration for @reearth/core on
npmjs.com (repo reearth/core, workflow release_alpha.yml) before it runs.

Author: bnimit

.github/workflows/release_alpha.yml

@@ -1,19 +1,82 @@
+# Releases @reearth/core to the `alpha` dist-tag on npm.
+#
+# Publishing is secured via npm Trusted Publishing (OIDC): no long-lived
+# NPM_TOKEN is used, and every publish carries a provenance attestation
+# (verify with `npm audit signatures`).
+#
+# One-time prerequisite (do this BEFORE the first run on the alpha branch):
+#   On npmjs.com: @reearth/core -> Settings -> Trusted publishers -> add
+#     Organization/user: reearth
+#     Repository:        core
+#     Workflow filename: release_alpha.yml
+#   (Leave environment blank.) This tells npm to accept OIDC tokens minted by
+#   this exact workflow instead of an NPM_TOKEN secret.
+#
+# The version bump commit + tag are still pushed to the protected alpha branch
+# using the PAT secret (an account that can push directly to alpha). Only the
+# npm publish step moved to OIDC; the git push credential is unchanged.
+#
+# beta/latest still publish via npm_release.yml + NPM_TOKEN and are unaffected.
+
+name: Release Alpha
+
 on:
   push:
     branches: alpha
     paths-ignore:
       - "package.json"
   workflow_dispatch:
 
+permissions:
+  contents: write # push the version bump commit + tag
+  id-token: write # mint the OIDC token for npm Trusted Publishing + provenance
+
 jobs:
   release:
-    permissions:
-      contents: write
-    uses: reearth/core/.github/workflows/npm_release.yml@beta
-    with:
-      branch: alpha
-      tag: alpha
-      version-args: --preid alpha prerelease
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      PAT: ${{ secrets.PAT }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # PAT (not GITHUB_TOKEN) so the bump commit/tag can be pushed
+          # directly to the protected alpha branch.
+          token: ${{ secrets.PAT }}
+      - uses: actions/setup-node@v4
+        with:
+          # Trusted Publishing requires Node >=22.14 and npm >=11.5.1.
+          node-version: 22
+          registry-url: "https://registry.npmjs.org"
+      - name: Activate npm via corepack
+        # Node 22 ships npm 10.x; Trusted Publishing needs >=11.5.1. corepack
+        # fetches a fresh npm binary directly, avoiding the broken self-upgrade
+        # path in the bundled npm 10.x.
+        run: |
+          corepack enable npm
+          corepack prepare npm@11.5.1 --activate
+          npm --version
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir-path
+        run: echo "path=$(yarn cache dir)" >> $GITHUB_OUTPUT
+      - uses: actions/cache@v4
+        with:
+          path: ${{ steps.yarn-cache-dir-path.outputs.path }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-yarn-
+      - name: Run install
+        run: yarn install --frozen-lockfile
+      - name: Set up github actions user
+        run: |
+          git config --global user.name "keiya01"
+          git config --global user.email "34934510+keiya01@users.noreply.github.com"
+      - name: Run npm version
+        # Triggers the preversion (yarn test run) and version (yarn build) npm
+        # scripts, so the package is tested and built before publish.
+        run: npm version --preid alpha prerelease
+      - name: Git push
+        run: |
+          git push origin alpha
+          git push --tags
+      - name: Publish to npm with provenance (OIDC)
+        # No NPM_TOKEN: auth is via the OIDC handshake configured as a Trusted
+        # Publisher on npmjs.com. --access public because @reearth/core is scoped.
+        run: npm publish --provenance --access public --tag alpha