SAN: publish @linqapp/cli to npm via OIDC trusted publishing

.github/workflows/release.yml

@@ -8,6 +8,11 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  # Required for npm Trusted Publishing (OIDC). GitHub issues a short-lived
+  # OIDC token that npm exchanges for publish auth — no NPM_TOKEN secret
+  # needed. Trusted publisher is registered on npmjs.com against this
+  # repo + workflow filename.
+  id-token: write
 
 jobs:
   release:
@@ -25,6 +30,12 @@ jobs:
           cache: 'npm'
           registry-url: 'https://registry.npmjs.org'
 
+      # npm Trusted Publishing requires npm CLI >= 11.5.1. Node 22 LTS
+      # ships with an older npm on some patches, so pin to latest npm
+      # explicitly before publishing.
+      - name: Upgrade npm to latest
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
@@ -37,5 +48,4 @@ jobs:
       - name: Semantic Release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release

.releaserc.json

@@ -9,7 +9,7 @@
         "changelogFile": "CHANGELOG.md"
       }
     ],
-    ["@semantic-release/npm", { "npmPublish": false }],
+    ["@semantic-release/npm", { "npmPublish": true }],
     [
       "@semantic-release/git",
       {