From 3180a7bdbf9fa13187cf9c48e8a5dc877035f245 Mon Sep 17 00:00:00 2001
From: EL JABIRI Tarik <tarik.eljabiri@gmail.com>
Date: Tue, 15 Sep 2026 23:44:42 +0100
Subject: [PATCH 1/2] ci: publish to npm via OIDC trusted publishing

Replace the legacy NPM_TOKEN auth (restricted by npm's 2FA-bypass
policy) with OIDC trusted publishing. bun publish has no OIDC support,
so publish with npm while keeping bun for install/build/test. Adds
id-token: write permission and --provenance.
---
 .github/workflows/cd.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 4cb2c04..11e7f9a 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -8,17 +8,23 @@ jobs:
   CD:
     name: CD
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for npm OIDC trusted publishing
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
       - run: bun install --frozen-lockfile
       - run: bun run coverage
       - run: bun run build
       - name: Publish to npm
+        # bun publish has no OIDC support yet, so publish with npm.
+        # No token: auth comes from the trusted publisher configured on npm.
         run: |
-          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-          bun publish
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm install -g npm@latest
+          npm publish --provenance --access public

From 91fa22d853ffaaf48738823611874344e4208219 Mon Sep 17 00:00:00 2001
From: EL JABIRI Tarik <tarik.eljabiri@gmail.com>
Date: Tue, 15 Sep 2026 23:46:19 +0100
Subject: [PATCH 2/2] ci: run tests (not coverage) in CD and allow manual
 dispatch

Slim the pre-publish gate to bun run test, and add workflow_dispatch so
2.9.0 can be published manually without recreating the release.
---
 .github/workflows/cd.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 11e7f9a..cc77f42 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -3,6 +3,7 @@ name: CD
 on:
   release:
     types: [published]
+  workflow_dispatch:
 
 jobs:
   CD:
@@ -20,7 +21,7 @@ jobs:
         with:
           node-version: 22
       - run: bun install --frozen-lockfile
-      - run: bun run coverage
+      - run: bun run test
       - run: bun run build
       - name: Publish to npm
         # bun publish has no OIDC support yet, so publish with npm.