ci: mirror nbtcal's working OIDC publish job exactly

Author: m1ngsama

.github/workflows/publish.yml

@@ -5,26 +5,24 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+  id-token: write # OIDC for npm trusted publishing
+
 jobs:
   publish:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
           cache: "npm"
-
+      # Trusted publishing needs npm >= 11.5.1, newer than the bundled version.
+      - run: npm install -g npm@latest
       - run: npm ci
-
       - run: npm run build
-
       - name: Check tag matches package version
         run: |
           TAG_VERSION=${GITHUB_REF#refs/tags/v}
@@ -33,15 +31,5 @@ jobs:
             echo "Version mismatch: tag v$TAG_VERSION, package.json v$PKG_VERSION" >&2
             exit 1
           fi
-
-      # OIDC trusted publishing: no stored token. Requires npm >= 11.5.1 and a
-      # trusted publisher configured on npmjs for @nbtca/prompt (publish.yml).
-      # --provenance engages the OIDC id-token for both auth and provenance.
-      - name: Publish
-        run: |
-          npm install -g npm@latest
-          # setup-node writes a dummy _authToken into this .npmrc; remove it so
-          # npm uses the OIDC-exchanged credential (not the fake token) for the
-          # registry write. --provenance forces npm to engage OIDC.
-          sed -i '/_authToken/d' "$NPM_CONFIG_USERCONFIG"
-          npm publish --access public --provenance
+      # Auth via OIDC trusted publishing — no NPM_TOKEN, no stored secret.
+      - run: npm publish --access public