From 288d108c03759bd704918bc90384b9a2a0c94299 Mon Sep 17 00:00:00 2001
From: Filip Hric <filip@filiphric.sk>
Date: Sun, 28 Jun 2026 23:08:51 +0200
Subject: [PATCH] ci: enable npm trusted publishing (OIDC)

- Add id-token: write permission so GitHub mints an OIDC token
- Upgrade npm to >= 11.5.1 (required for trusted publishing)
- Remove NPM_TOKEN so the OIDC exchange is used instead of legacy token
- Bump actions/checkout to v4 and run it before setup-node
---
 .github/workflows/tests.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5409328..f75e3c4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -3,13 +3,18 @@ on: [push]
 jobs:
   cypress-run:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write       # semantic-release pushes tags / GitHub release
+      id-token: write       # required for npm trusted publishing (OIDC)
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '22.14.0'
-      - name: Checkout
-        uses: actions/checkout@v2
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest   # needs >= 11.5.1
       - name: Cypress run
         uses: cypress-io/github-action@v5
         with:
@@ -26,4 +31,4 @@ jobs:
           semantic_version: ^25.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
\ No newline at end of file
+          # NPM_TOKEN removed — OIDC trusted publishing handles auth
\ No newline at end of file