ci: restore OIDC publishing, bump 0.2.6 → 0.2.7

The npm Trusted Publisher binding (Sharp-API/sharpapi-ts → publish.yml)
turns out to have been correctly configured all along — the OIDC 404
on v0.2.5 may have been a transient handshake issue or required the
NPM_TOKEN publish (v0.2.6) to fully activate the package↔workflow
trust on the npm side.

Drop the NODE_AUTH_TOKEN env var so npm publish falls back to OIDC
(no _authToken in .npmrc → npm uses the GitHub OIDC token). The
NPM_TOKEN secret stays in the repo for break-glass.

Cutting 0.2.7 as the smoke test. No source changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Mlaz-code

.github/workflows/publish.yml

@@ -54,14 +54,14 @@ jobs:
         # Only publish on an actual release event. workflow_dispatch
         # runs through test+build as a dry run but must not upload.
         #
-        # Auth: NPM_TOKEN secret. The Trusted Publisher (OIDC) config at
+        # Auth: Trusted Publisher (OIDC). npm picks up the GitHub OIDC
+        # token automatically when no _authToken is configured. Trust is
+        # registered at:
         #   https://www.npmjs.com/package/@sharp-api/client/access
-        # was returning 404 on PUT for v0.2.5 (silent permission denial),
-        # so we fall back to the long-lived NPM_TOKEN. Re-enable OIDC by
-        # confirming the Trusted Publisher binding still maps to this
-        # workflow filename + repo + ref pattern after any rename.
-        # --provenance still emits the SLSA attestation either way.
+        # (Trusted Publishers → Sharp-API/sharpapi-ts → publish.yml).
+        # NPM_TOKEN secret remains in the repo as a break-glass fallback
+        # (add `env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` back if
+        # OIDC ever regresses to 404/permission-denied).
+        # --provenance emits the SLSA attestation.
         if: github.event_name == 'release'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --provenance --access public

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sharp-api/client",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "Official TypeScript/JavaScript client for the SharpAPI real-time sports betting odds API",
   "type": "module",
   "main": "./dist/index.cjs",