Summary

Switches the publish workflow back to trusted publishing (OIDC). npm trades the short-lived token GitHub mints for this specific workflow run for permission to publish, so there is no long-lived credential in the repository at all.

This is the version from 18d9084 restored, plus one addition below.

What is new versus last time

The first attempt failed in a way that named neither OIDC nor trusted publishing:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/moshcode
npm error 404  ... could not be found or you do not have permission

With no publisher registered there is no credential in the run at all, and npm reports it as though the package does not exist. The workflow header now spells that out, because working it out cost a release.

Unrelated, already fixed

The E422 that stopped v0.24.1 was a different problem — missing repository in package.json, which provenance is validated against. That landed in #308, and v0.24.2 published successfully with a SLSA attestation. Provenance stays automatic under trusted publishing, so the explicit --provenance flag is gone.

Still required

The publisher must be registered on npmjs.com for the moshcode package, against this file's name — publish.yml:

Nothing in the repo can verify this — the registry does not expose trusted-publisher config, which I checked. The next release is the proof. A dispatch run cannot test it, because 0.24.2 is already published and the skip guard would stop before the publish.

Verification

• YAML parses; 11 steps; permissions exactly contents: read + id-token: write
• zero secrets. references remain
• --provenance correctly absent from the publish command (comment only)

🤖 Generated with Claude Code