ci: npm Trusted Publishing으로 전환 (토큰 제거)

[jeongph]

npm이 CI/CD용 장기 토큰(2FA bypass) 대신 Trusted Publishing(OIDC) 을 권장하므로 전환한다. Refs #10

변경

• NODE_AUTH_TOKEN/NPM_TOKEN 제거 — OIDC 단기 토큰으로 인증 (npm CLI가 자동 감지)
• --provenance 플래그 제거 — Trusted Publishing에서는 provenance가 자동 생성됨
• Node 20 → 24 (OIDC 요구사항: node 22.14+ / npm 11.5.1+)
• runs-on: ubuntu-latest 유지 (GitHub-hosted 러너만 지원)

장점

• 저장할 장기 자격증명이 없음(유출·만료 리스크 제거)
• provenance 자동 → 공급망 검증

전제

npm 패키지 설정에 Trusted Publisher 등록 필요 (org followingseas, repo pilot, workflow publish.yml). 패키지가 존재해야 등록 가능하므로 첫 배포는 로컬에서 1회 수행하고, 이후 릴리스부터 이 워크플로가 담당한다.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the package publishing workflow to use npm Trusted Publishing with GitHub OIDC, eliminating the need for long-lived publishing tokens.
  • Upgraded the publishing environment to Node.js 24.
  • Simplified the publish process so npm handles authentication and provenance automatically while keeping the existing automated release flow.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 916a22ca-6750-4233-a50a-d1d68a13cc23

📥 Commits

Reviewing files that changed from the base of the PR and between ae714eb and d1af622.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

---

📝 Walkthrough

Walkthrough

The release workflow continues publishing on published GitHub Releases, upgrades Node.js from 20 to 24, and replaces token authentication and explicit provenance flags with npm Trusted Publishing through GitHub OIDC.

Changes

npm Trusted Publishing

Layer / File(s)	Summary
Release publishing authentication and runtime .github/workflows/publish.yml	The workflow grants OIDC permissions, disables checkout credential persistence, uses Node.js 24 with pinned npm 11.8.0, runs tests, and publishes through npm Trusted Publishing without NPM_TOKEN or an explicit --provenance flag.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubRelease
  participant GitHubActions
  participant NpmRegistry
  GitHubRelease->>GitHubActions: Trigger published release workflow
  GitHubActions->>GitHubActions: Issue OIDC identity token
  GitHubActions->>NpmRegistry: Run tokenless npm publish
  NpmRegistry-->>GitHubActions: Authenticate and generate provenance

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: moving npm publishing to Trusted Publishing and removing token-based auth.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/trusted-publishing

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Line 17: Update the actions/checkout@v4 step in the publish workflow to set
persist-credentials to false, ensuring the checkout does not retain the
GITHUB_TOKEN in local git configuration while leaving the existing workflow
steps unchanged.
- Line 20: Update the Node 24 setup in the publish workflow to ensure npm 11.5.1
or newer is available before the publish step, either by explicitly installing
that npm version or enabling check-latest for Node. Keep the existing npm
publish flow unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7a4742be-76f4-42e1-9434-d1ba4edc45bc

📥 Commits

Reviewing files that changed from the base of the PR and between 2d6481e and a27da5c.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Line 26: Update the OIDC publish job’s npm installation step to pin a tested
npm version at or above 11.5.1 instead of using npm@latest, and add
--ignore-scripts to the installation command.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8c44df25-d905-4801-ac89-083b0d91e471

📥 Commits

Reviewing files that changed from the base of the PR and between a27da5c and ae714eb.

📒 Files selected for processing (1)

• .github/workflows/publish.yml