chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled

[wyattjoh]

Removes NODE_AUTH_TOKEN from all three npm publish jobs now that OIDC trusted publishing is configured for the package on npmjs.com.

Do not merge until OIDC trusted publishing is enabled on npmjs.com for this package.

Affects:

• publish-npm (stable release)
• canary-publish-npm (canary release)
• publish (snapshot release)

[wyattjoh]

Stack: npm-publishing-fixes

• chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled #135 👈 this PR

Part of a stacked PR chain. Do not merge manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e76ba2fc-4f0d-4691-8718-30a51d8e2985

📥 Commits

Reviewing files that changed from the base of the PR and between 4ae3d0e and f9175f6.

📒 Files selected for processing (4)

• .github/workflows/release.yml
• .github/workflows/snapshot.yml
• docs/releasing.md
• scripts/lib/npm.ts

💤 Files with no reviewable changes (1)

• .github/workflows/snapshot.yml

✅ Files skipped from review due to trivial changes (1)

• scripts/lib/npm.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

Consolidates CI workflows by deleting .github/workflows/snapshot.yml and folding snapshot behavior into .github/workflows/release.yml: release.yml now also triggers on issue_comment (snapshot comments starting with !snapshot), uses dynamic job-level concurrency for comment events, gates the versioning job to push events, propagates release_created outputs with simplified references, and implements a snapshot pipeline that validates commenter association, captures PR head SHA and fork status, computes optional snapshot names, builds/signs/smoke-tests artifacts, publishes snapshots via OIDC on ubuntu-latest, and comments/reacts on PRs. Additionally, NODE_AUTH_TOKEN was removed from NPM publish steps in release.yml, scripts/lib/npm.ts adds the --provenance flag to npm publish, and docs/releasing.md was updated to reflect the consolidated workflows.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: removing NODE_AUTH_TOKEN from npm publish jobs in favor of OIDC, which aligns with the primary objective of the pull request.
Description check	✅ Passed	The description clearly explains the motivation (OIDC trusted publishing now enabled), lists the affected npm publish jobs, and includes an important blocker warning about merge prerequisites.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dominic-clerk]

I have added a commit combining both release workflows (snapshot.yml and release.yml) as npm allows the configuration of only one trusted workflow.

Here's the claude summary of the changes

What changed:

• Added issue_comment trigger alongside push — snapshot jobs gate on github.event_name == 'issue_comment', release/canary jobs gate on push
• Snapshot jobs prefixed with snapshot- to avoid name collisions
• Concurrency group is now dynamic: release-main for pushes, release-snapshot-{PR#} for snapshot comments
• Removed NODE_AUTH_TOKEN (OIDC replaces it)
• Deleted snapshot.yml

No behavioral changes to any of the three release channels (stable, canary, snapshot).