[codex] Switch npm release to trusted publishing

[nahtnam]

Changes

• Grants the release workflow id-token: write so npm can use GitHub Actions OIDC trusted publishing.
• Keeps contents: write and pull-requests: write for Changesets version PRs/commits.
• Configures actions/setup-node with the npm registry URL.
• Installs the latest npm CLI before changeset publish, then removes the long-lived NPM_TOKEN from the publish environment.

Why

The publish run failed with npm E404 Not Found while trying to publish patchworks@0.1.3, which is the error npm returns when the registry request is not authorized for that package. Moving to trusted publishing avoids a stale or incorrectly scoped npm token and lets npm authorize the exact GitHub Actions workflow through OIDC.

Required npm setup

Configure the patchworks package on npmjs.com with a Trusted Publisher:

• Provider: GitHub Actions
• Organization/user: ludicroushq
• Repository: patchworks
• Workflow filename: release.yaml
• Allowed action: npm publish

Validation

• pnpm run ci:test:pretty
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
patchworks	Error		Jun 17, 2026 3:04am