fix: publish npm releases through trusted OIDC identity

.github/workflows/release.yml

@@ -412,17 +412,6 @@ jobs:
           "$TMP_BIN/fclt" status --json >/dev/null
           "$TMP_BIN/facult" --help
 
-      - name: Ensure NPM_TOKEN is configured
-        shell: bash
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [[ -z "${NPM_TOKEN:-}" ]]; then
-            echo "NPM_TOKEN secret is required for npm publish."
-            exit 1
-          fi
-
       - name: Skip publish if version already exists on npm
         id: npm-check
         shell: bash
@@ -440,7 +429,6 @@ jobs:
       - name: Publish to npm
         if: steps.npm-check.outputs.exists == 'false'
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: "true"
           HUSKY: "0"
         run: npm publish --access public --provenance

scripts/release-workflow.test.ts

@@ -56,3 +56,21 @@ it("publishes checksummed SBOM-bearing release assets with build provenance", as
       : ""
   ).toContain("SHA256SUMS");
 });
+
+it("publishes npm through OIDC without a stored publish token", async () => {
+  const text = await Bun.file(
+    new URL("../.github/workflows/release.yml", import.meta.url)
+  ).text();
+  const workflow = parseYaml(text);
+  const job = workflow.jobs["publish-npm"];
+  expect(job["runs-on"]).toBe("ubuntu-latest");
+  expect(job.permissions["id-token"]).toBe("write");
+  expect(JSON.stringify(job)).not.toContain("NPM_TOKEN");
+  expect(JSON.stringify(job)).not.toContain("NODE_AUTH_TOKEN");
+  expect(
+    job.steps.some(
+      (step: Record<string, unknown>) =>
+        step.run === "npm publish --access public --provenance"
+    )
+  ).toBe(true);
+});