From a3dca3066c474877f6c514c651fda9cec73aac7f Mon Sep 17 00:00:00 2001
From: Lucas-FullStackX <lucasleguizamo21@gmail.com>
Date: Sun, 12 Jul 2026 13:24:47 -0500
Subject: [PATCH] ci: publish CLI with npm trusted publishing

---
 .github/workflows/release.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c26cdae..3b5222b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,7 @@ jobs:
       - run: pnpm generate
       - run: pnpm test
       - run: pnpm build
-      - run: pnpm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      # npm Trusted Publishing exchanges this GitHub OIDC identity for a
+      # short-lived publish credential; no long-lived NPM_TOKEN is stored.
+      - run: npm install --global npm@latest
+      - run: npm publish --provenance --access public