From b82280357e5353b5c08ba4cdbb498e66df899cae Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 25 May 2026 16:08:54 +0000
Subject: [PATCH 1/2] Initial plan


From 349a4ab19015f887ed8c5e997dac871dad398f16 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 25 May 2026 16:13:28 +0000
Subject: [PATCH 2/2] ci: use npm trusted publishing for tag releases

Agent-Logs-Url: https://github.com/mia-platform/lc39/sessions/2d1b6a4a-78ff-4b3c-9e8e-8094ff9be7f0

Co-authored-by: ThisIsDemetrio <5429953+ThisIsDemetrio@users.noreply.github.com>
---
 .github/workflows/node.js.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index 8f8dccf..d710866 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -42,6 +42,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -62,6 +65,4 @@ jobs:
           else
             echo "tag=latest" >> "$GITHUB_OUTPUT"
           fi
-      - run: npm publish --access public --tag ${{ steps.npm-tag.outputs.tag }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - run: npm publish --access public --provenance --tag ${{ steps.npm-tag.outputs.tag }}