Removed NPM token flow

Author: Swader

.github/workflows/npm-publish.yml

@@ -10,6 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -19,6 +20,12 @@ jobs:
         with:
           bun-version: "1.3.4"
 
+      - name: Setup Node (for npm publish with OIDC)
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
@@ -34,12 +41,6 @@ jobs:
           publish=$(bun -e "const pkg=require('./package.json'); const res=await fetch('https://registry.npmjs.org/' + encodeURIComponent(pkg.name)); if (!res.ok) { console.log('true'); } else { const data=await res.json(); console.log(data.versions && data.versions[pkg.version] ? 'false' : 'true'); }")
           echo "publish=$publish" >> $GITHUB_OUTPUT
 
-      - name: Configure npm auth
-        if: steps.npm.outputs.publish == 'true'
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-
       - name: Publish
         if: steps.npm.outputs.publish == 'true'
-        run: bun publish --access public
+        run: npm publish --provenance --access public

README.md

@@ -20,7 +20,6 @@ contract.
 
 ```shell
 bun install
-bun run docs:import
 bun run test
 bun run coverage
 bun run build:artifacts
@@ -50,12 +49,10 @@ package with `bun publish --access public` when the package version is not alrea
 
 Cloudflare Pages settings:
 
-- **Build command**: `bun run docs:build`
+- **Build command**: `bun install && bun run docs:build`
 - **Output directory**: `out`
 
-Required secrets for automation:
-
-- `NPM_TOKEN` for npm publishing
+npm publishing uses OIDC Trusted Publishing (no secrets required).
 
 ## RMRK Legos