ci: switch back to NPM_TOKEN auth (granular token) — keep provenance

Trusted publishing requires per-package UI setup on npmjs.com, which is
fine for one package but doesn't scale across many. Reverting auth to a
granular access token while keeping the provenance attestation:

- `.github/workflows/ci.yml`: re-add `NPM_TOKEN: ${{ secrets.NPM_TOKEN }}`
  for auth. Keep `id-token: write` permission — provenance signing uses
  the OIDC token regardless of auth method.
- `publishConfig.provenance: true` stays in `package.json`, so the npm
  package page still gets the "Built and signed on GitHub Actions" badge
  linking back to the workflow run.

Maintainer setup
- npmjs.com → Account → Access Tokens → Generate New → Granular Access
  Token. Scope: read+write on `react-json-logic` (or a wildcard like
  `react-json-logic*` / `@uinaf/*` for org-wide reuse).
- GH repo → Settings → Secrets → New repository secret `NPM_TOKEN`. Or
  set as an org-level secret to share across uinaf OSS repos.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: altaywtf

.github/workflows/ci.yml

@@ -48,8 +48,11 @@ jobs:
       contents: write
       issues: write
       pull-requests: write
-      # Required for npm Trusted Publishing (OIDC) — no NPM_TOKEN needed.
-      # The OIDC token is also used to attach provenance to the published artifact.
+      # OIDC is used only for npm provenance attestation
+      # ("Built and signed on GitHub Actions" badge on the npm package page).
+      # Auth uses NPM_TOKEN (granular access token). Trusted publishing was
+      # considered but rejected — the per-package npm UI setup doesn't scale
+      # across many packages.
       id-token: write
 
     steps:
@@ -83,6 +86,7 @@ jobs:
             conventional-changelog-conventionalcommits
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           GIT_AUTHOR_NAME: uinafdev
           GIT_AUTHOR_EMAIL: dev@uinaf.dev
           GIT_COMMITTER_NAME: uinafdev

AGENTS.md

@@ -44,9 +44,9 @@ For per-package work, `cd` into the package dir and run `vp <command>` directly.
 
 Conventional commits drive the version: `feat:` → minor, `fix:` → patch, `feat!:`/`BREAKING CHANGE:` → major. Skip a release with `[skip ci]` in the commit message.
 
-**Auth uses npm Trusted Publishing (OIDC) — no `NPM_TOKEN` secret needed.** The release job carries `id-token: write`; npm validates the OIDC token against the package's [Trusted Publisher](https://docs.npmjs.com/trusted-publishers/) entry. `publishConfig.provenance: true` adds a [provenance attestation](https://docs.npmjs.com/generating-provenance-statements/) to every release.
+**Auth uses a granular npm access token** stored as `NPM_TOKEN` in the GH repo (or as an org-level secret, shared across uinaf repos). `publishConfig.provenance: true` adds a [provenance attestation](https://docs.npmjs.com/generating-provenance-statements/) to every release via OIDC — the "Built and signed on GitHub Actions" badge on the npm package page links back to the workflow run.
 
-To enable: on npmjs.com, open the `react-json-logic` package settings → Trusted Publishers → Add → provider GitHub Actions, repository `uinaf/react-json-logic`, workflow filename `ci.yml`. (No environment.) Once configured, every push to `main` that warrants a release publishes automatically with provenance.
+Trusted publishing (OIDC-only auth, no token) is the more secure option but requires per-package UI setup on npmjs.com, which doesn't scale across many packages. Granular tokens are the pragmatic middle ground.
 
 Node version is locked in `.node-version` at the workspace root — both CI and the Cloudflare Pages demo deploy read it.
 

packages/react-json-logic/AGENTS.md

@@ -52,9 +52,9 @@ Auto-published to npm by `.github/workflows/ci.yml` on every push to `main`:
 - semantic-release reads `.releaserc.json` from this directory and runs from here via `working_directory: packages/react-json-logic` in the workflow.
 - Skip a release on a given push by including `[skip ci]` in the commit message.
 
-**Auth: npm Trusted Publishing (OIDC).** No `NPM_TOKEN` secret. The release job has `id-token: write` permission, GitHub Actions mints a short-lived OIDC token, and npm verifies it against the package's [Trusted Publisher](https://docs.npmjs.com/trusted-publishers/) config. `publishConfig.provenance: true` in `package.json` attaches a [provenance attestation](https://docs.npmjs.com/generating-provenance-statements/) to every published version, so npm shows a "Built and signed on GitHub Actions" badge with a link to the build.
+**Auth: granular npm access token.** The release job authenticates with `NPM_TOKEN` (a granular token scoped to this package). Trusted publishing was considered but rejected — npm requires per-package UI setup, which doesn't scale across many packages. `publishConfig.provenance: true` in `package.json` still attaches a [provenance attestation](https://docs.npmjs.com/generating-provenance-statements/) to every published version (provenance uses OIDC for signing only, independent of auth) so npm shows a "Built and signed on GitHub Actions" badge with a link to the build.
 
-`.node-version` at the workspace root locks the runner Node version so CI and the Cloudflare Pages demo (`react-json-logic.uinaf.dev`) agree. Trusted publishing requires npm 11.5.1+, which Node 24.14.0 ships with.
+`.node-version` at the workspace root locks the runner Node version so CI and the Cloudflare Pages demo (`react-json-logic.uinaf.dev`) agree.
 
 ## Notes for Future Work