ci: publish to npm via OIDC trusted publishing

.github/workflows/release.yml

@@ -8,6 +8,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release:
@@ -25,6 +26,10 @@ jobs:
           cache: 'npm'
           registry-url: 'https://registry.npmjs.org'
 
+      # Trusted publishing (OIDC) requires npm >= 11.5.1; runners ship npm 10.x
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm ci
 
@@ -37,5 +42,4 @@ jobs:
       - name: Semantic Release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release

.releaserc.json

@@ -9,7 +9,7 @@
         "changelogFile": "CHANGELOG.md"
       }
     ],
-    ["@semantic-release/npm", { "npmPublish": false }],
+    "@semantic-release/npm",
     [
       "@semantic-release/git",
       {

README.md

@@ -7,6 +7,14 @@ A command-line interface for the [Linq](https://linqapp.com) messaging API. Send
 
 ## Installation
 
+### npm (cross-platform)
+
+Requires Node.js >= 22.
+
+```bash
+npm install -g @linqapp/cli
+```
+
 ### Homebrew (macOS / Linux)
 
 ```bash

package.json

@@ -131,6 +131,7 @@
     "url": "https://github.com/linq-team/linq-cli/issues"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }