From a6021d8fc47372873a96c5a6a2795e7fb5447b4d Mon Sep 17 00:00:00 2001
From: SMAKSS <kazemi914@live.com>
Date: Tue, 3 Nov 2026 02:49:26 +0000
Subject: [PATCH] ci(release): use npm trusted publishing

---
 .github/workflows/npm-publish.yml             |  5 +-
 .github/workflows/publish-github-packages.yml | 95 -------------------
 AGENTS.md                                     |  2 +-
 3 files changed, 5 insertions(+), 97 deletions(-)
 delete mode 100644 .github/workflows/publish-github-packages.yml

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 4d1405a..d01f3ab 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -11,6 +11,7 @@ jobs:
       contents: write
       issues: write
       pull-requests: write
+      id-token: write
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -24,6 +25,9 @@ jobs:
           cache: true
           require-lockfile: true
 
+      - name: Ensure npm CLI supports trusted publishing
+        run: npm install -g npm@11.5.1
+
       - name: Build package
         run: pnpm run generate
 
@@ -31,4 +35,3 @@ jobs:
         run: pnpm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-github-packages.yml b/.github/workflows/publish-github-packages.yml
deleted file mode 100644
index 2f1c791..0000000
--- a/.github/workflows/publish-github-packages.yml
+++ /dev/null
@@ -1,95 +0,0 @@
-name: Publish @smakss/random-string to GitHub Packages
-
-on:
-  workflow_run:
-    workflows: ['Release @smakss/random-string']
-    types: [completed]
-    branches: [master]
-
-concurrency:
-  group: github-packages-${{ github.event.workflow_run.head_sha }}
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    if: github.event.workflow_run.conclusion == 'success'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.workflow_run.head_sha }}
-          fetch-depth: 0
-
-      - name: Find semantic-release tag
-        id: release
-        env:
-          RELEASE_SHA: ${{ github.event.workflow_run.head_sha }}
-        run: |
-          tag="$(git describe --tags --exact-match "$RELEASE_SHA" 2>/dev/null || true)"
-          case "$tag" in
-            v[0-9]*)
-              echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "version=" >> "$GITHUB_OUTPUT"
-              ;;
-          esac
-
-      - name: Configure GitHub Packages registry
-        if: steps.release.outputs.version != ''
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version-file: .nvmrc
-          registry-url: https://npm.pkg.github.com/
-          scope: "@smakss"
-
-      - name: Setup pnpm and dependencies
-        if: steps.release.outputs.version != ''
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          node-version-file: false
-          cache: true
-          require-lockfile: true
-
-      - name: Set package version from release tag
-        if: steps.release.outputs.version != ''
-        env:
-          RELEASE_VERSION: ${{ steps.release.outputs.version }}
-        run: |
-          node -e '
-            const fs = require("node:fs");
-            const packageJson = JSON.parse(fs.readFileSync("package.json", "utf8"));
-            packageJson.version = process.env.RELEASE_VERSION;
-            fs.writeFileSync("package.json", `${JSON.stringify(packageJson, null, 2)}\n`);
-          '
-
-      - name: Build package
-        if: steps.release.outputs.version != ''
-        run: pnpm run generate
-
-      - name: Check if version is already published
-        id: registry
-        if: steps.release.outputs.version != ''
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PACKAGE_NAME: "@smakss/random-string"
-          RELEASE_VERSION: ${{ steps.release.outputs.version }}
-        run: |
-          if npm view "${PACKAGE_NAME}@${RELEASE_VERSION}" version --registry=https://npm.pkg.github.com/ >"$RUNNER_TEMP/npm-view.log" 2>&1; then
-            echo "published=true" >> "$GITHUB_OUTPUT"
-          elif grep -Eq 'E404|404 Not Found' "$RUNNER_TEMP/npm-view.log"; then
-            echo "published=false" >> "$GITHUB_OUTPUT"
-          else
-            cat "$RUNNER_TEMP/npm-view.log" >&2
-            exit 1
-          fi
-
-      - name: Publish to GitHub Packages
-        if: steps.release.outputs.version != '' && steps.registry.outputs.published != 'true'
-        run: pnpm publish --no-git-checks --registry=https://npm.pkg.github.com/
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/AGENTS.md b/AGENTS.md
index 5098a99..c9c5e52 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,7 +14,7 @@
 - Keep security behavior and runtime requirements aligned with Readme.md. Add regression coverage and update docs when behavior changes.
 - Keep playground examples representative of the published package API; do not import private source paths.
 - Use Conventional Commit messages; semantic-release derives versions and release notes from them.
-- semantic-release publishes release-worthy changes to npm and GitHub Packages from the default branch. Do not change versions manually or publish outside that workflow unless explicitly requested.
+- semantic-release publishes release-worthy changes to npm from the default branch. Do not change versions manually or publish outside that workflow unless explicitly requested.
 
 ## Useful commands