feat: migrate npm-release.yml to OIDC trusted publishing

.github/workflows/npm-release.yml

@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: write      # push version commits, create GitHub releases
       pull-requests: write # create/update the "[ci] release" PR
-      id-token: write      # OIDC for npm provenance attestation
+      id-token: write      # OIDC for npm trusted publishing AND provenance attestation
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -33,7 +33,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: "18.20"
+          node-version: "24"
           cache: 'pnpm'
           registry-url: 'https://registry.npmjs.org'
 
@@ -56,6 +56,8 @@ jobs:
           # scoped to this repo only (contents:write, pull-requests:write),
           # rotated every 2 hours via github-actions-access-provider.
           GITHUB_TOKEN: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
+          # Empty NPM_TOKEN forces npm to fall through to OIDC token exchange.
+          # Do NOT set NODE_AUTH_TOKEN — setup-node's registry-url writes it
+          # into .npmrc; leaving it undefined triggers the OIDC flow.
+          NPM_TOKEN: ''
+          NPM_CONFIG_PROVENANCE: true

package.json

@@ -12,7 +12,10 @@
   ],
   "description": "BuyButton.js allows merchants to build Shopify interfaces into any website",
   "main": "lib/buybutton.umd.js",
-  "repository": "git@github.com:Shopify/buy-button-js.git",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/buy-button-js.git"
+  },
   "publishConfig": {
     "access": "public",
     "@shopify:registry": "https://registry.npmjs.org/",