Merge pull request #81 from supermemoryai/vorflux/fix-npm-publish

fix: switch to npm trusted publishing (OIDC) and fix yarn publish bug

Author: Dhravya

.github/workflows/publish-npm.yml

@@ -18,14 +18,22 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
 
     steps:
       - uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Upgrade npm for trusted publishing support
+        run: npm install -g npm@latest
+
+      - name: Enable corepack
+        run: corepack enable
 
       - name: Install dependencies
         run: |
@@ -41,7 +49,6 @@ jobs:
           yarn tsn scripts/publish-packages.ts "{ \"paths_released\": \"$PATHS_RELEASED\" }"
         env:
           INPUT_PATH: ${{ github.event.inputs.path }}
-          NPM_TOKEN: ${{ secrets.SUPERMEMORY_NPM_TOKEN || secrets.NPM_TOKEN }}
 
       - name: Upload MCP Server DXT GitHub release asset
         run: |

bin/publish-npm

@@ -2,8 +2,6 @@
 
 set -eux
 
-npm config set '//registry.npmjs.org/:_authToken' "$NPM_TOKEN"
-
 yarn build
 cd dist
 
@@ -57,5 +55,5 @@ else
   TAG="latest"
 fi
 
-# Publish with the appropriate tag
-yarn publish --tag "$TAG"
+# Publish with the appropriate tag using npm trusted publishing (OIDC provenance)
+npm publish --tag "$TAG" --provenance