fix(release): publish npm with trusted publishing

[pitzcarraldo]

Summary

Publish npm releases through npm Trusted Publishing/OIDC instead of an npm token.

Details

• Removes NODE_AUTH_TOKEN from the publish step so npm can use the configured Trusted Publisher.
• Pins the publish job to Node 24 and upgrades npm to ^11.15.0, which satisfies npm Trusted Publishing requirements.
• Keeps set -o pipefail so publish failures are not hidden by tee.
• Updates setup docs to describe the Trusted Publisher configuration instead of NPM_TOKEN.

Related Issues

Related to #XXXX

How to Validate

1. Run bun run check && bun test.
2. Run bun run build && bun test tests/e2e/.
3. Re-run the Release workflow and verify publish-npm uses npm 11+ without NODE_AUTH_TOKEN.

Pre-Merge Checklist

Code Quality

• Code builds without errors (bun run build)
• Types check correctly (bun run typecheck)
• Linter passes (bun run lint)
• Tests pass (bun test)
• Added/updated tests for new functionality (if applicable)

Documentation

• Updated relevant documentation (if needed)
• Updated CLAUDE.md if architecture changed (if needed)

Commit Standards

• Commits follow Conventional Commits format
• No breaking changes, OR breaking changes are documented

Platform Validation

• macOS
• Linux

Summary by CodeRabbit

• Documentation

  • Updated release setup guidance to use npm Trusted Publishing instead of a token-based secret flow, with clearer verification and troubleshooting steps.

• Bug Fixes

  • Improved the npm release process to better handle already-published versions and skip duplicate publishes gracefully.
  • Updated the release environment to use a newer Node.js version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 224332b6-9d93-497c-a2c0-74fc0008d5ae

📥 Commits

Reviewing files that changed from the base of the PR and between 22a3182 and 45fbe31.

📒 Files selected for processing (2)

• .github/SETUP.md
• .github/workflows/release.yml

---

Walkthrough

The release workflow's Node.js version is bumped from 22 to 24, and the npm publish step drops the --provenance flag while adding log-based handling to skip already-published version errors. SETUP.md is rewritten to describe npm Trusted Publishing (OIDC) instead of NPM_TOKEN-based authentication.

Changes

Release Workflow and Setup Docs

Layer / File(s)	Summary
Publish step Node version and error handling .github/workflows/release.yml	Node.js setup version changed from 22 to 24; npm publish invocation removes --provenance and adds conditional handling that skips the step when the log indicates the version was already published, otherwise fails.
Trusted Publishing setup documentation .github/SETUP.md	Replaces NPM_TOKEN secret instructions with Trusted Publisher (OIDC) configuration steps, updates verification text, and reworks the troubleshooting checklist to reference id-token permissions, npm version requirements, and ENEEDAUTH/E404 errors.

Possibly related PRs

• clix-so/clix-cli#23: Modifies the same .github/workflows/release.yml npm publish workflow for OIDC-based publishing, including id-token: write and publish invocation/provenance handling.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: switching npm publishing to Trusted Publishing.
Description check	✅ Passed	The description follows the template and includes a summary, details, related issue, validation steps, and checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-oidc-publish

---

_{Comment @coderabbitai help to get the list of available commands.}