From 87e98fc794c3b8d53f9cef959a855286613b92cc Mon Sep 17 00:00:00 2001
From: Josh Flayhart <josh.flayhart@linqapp.com>
Date: Fri, 22 May 2026 13:45:50 -0500
Subject: [PATCH] ci: publish to npm via OIDC trusted publishing

Enable npm registry publishing in the release pipeline:

- .releaserc.json: drop npmPublish:false so @semantic-release/npm
  publishes @linqapp/cli on release
- release.yml: add id-token:write for OIDC, upgrade npm to >=11.5.1
  (trusted publishing requirement), drop the NPM_TOKEN secret
- package.json: enable provenance attestations on publish
- README: document npm install option
---
 .github/workflows/release.yml | 6 +++++-
 .releaserc.json               | 2 +-
 README.md                     | 8 ++++++++
 package.json                  | 3 ++-
 4 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5e10e35..0088316 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release:
@@ -25,6 +26,10 @@ jobs:
           cache: 'npm'
           registry-url: 'https://registry.npmjs.org'
 
+      # Trusted publishing (OIDC) requires npm >= 11.5.1; runners ship npm 10.x
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
@@ -37,5 +42,4 @@ jobs:
       - name: Semantic Release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release
diff --git a/.releaserc.json b/.releaserc.json
index e64b95b..468f1b0 100644
--- a/.releaserc.json
+++ b/.releaserc.json
@@ -9,7 +9,7 @@
         "changelogFile": "CHANGELOG.md"
       }
     ],
-    ["@semantic-release/npm", { "npmPublish": false }],
+    "@semantic-release/npm",
     [
       "@semantic-release/git",
       {
diff --git a/README.md b/README.md
index e65a30f..10f9bde 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,14 @@ A command-line interface for the [Linq](https://linqapp.com) messaging API. Send
 
 ## Installation
 
+### npm (cross-platform)
+
+Requires Node.js >= 22.
+
+```bash
+npm install -g @linqapp/cli
+```
+
 ### Homebrew (macOS / Linux)
 
 ```bash
diff --git a/package.json b/package.json
index 53d8ddd..0de2089 100644
--- a/package.json
+++ b/package.json
@@ -131,6 +131,7 @@
     "url": "https://github.com/linq-team/linq-cli/issues"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }