release: ensure npm publishing uses OIDC

Avoid setup-node's generated empty token configuration, which can suppress npm's
trusted-publisher exchange. Pin a compatible npm CLI and support dispatching an
existing tag so failed publications can be retried without rewriting tags.
Normalize the repository URL to npm's canonical form for publisher validation.

Author: williamstein

.github/workflows/release.yml

@@ -4,6 +4,12 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to publish
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -14,15 +20,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag || github.ref }}
       - uses: actions/setup-node@v6
         with:
           node-version: "24"
-          registry-url: https://registry.npmjs.org
           package-manager-cache: false
+      - run: npm install --global npm@11.19.0
       - run: corepack enable
       - run: pnpm install --frozen-lockfile
       - name: Verify release tag
-        run: node --eval "if ('v' + require('./package.json').version !== process.env.GITHUB_REF_NAME) process.exit(1)"
+        env:
+          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+        run: node --eval "if ('v' + require('./package.json').version !== process.env.RELEASE_TAG) process.exit(1)"
       - run: pnpm audit --audit-level high
       - run: pnpm check
       - run: npm publish --access public

package.json

@@ -7,7 +7,7 @@
   "type": "module",
   "repository": {
     "type": "git",
-    "url": "https://github.com/sagemathinc/patchflow.git"
+    "url": "git+https://github.com/sagemathinc/patchflow.git"
   },
   "bugs": {
     "url": "https://github.com/sagemathinc/patchflow/issues"