fix release: migrate npm publish to OIDC trusted publishing (#197)

* fix release: migrate npm publish to OIDC trusted publishing

The 2.1.0 release never reached npm: the release job created the git
tag before publishing, so ncipollo/release-action failed with
422 already_exists (tag_name) and the job aborted before npm publish
ran. npm is still stuck at 2.0.0.

Align the workflow with react-apple-signin-auth's working setup:
- migrate to npm OIDC trusted publishing (id-token: write, bare
  npm publish, drop NODE_AUTH_TOKEN/NPM_TOKEN)
- bump Node to 24.x (ships npm >= 11.5.1, required for OIDC)
- guard the GitHub release and npm publish on whether the version
  tag already exists (check_tag), so re-runs no longer fail
- fetch-depth: 0 and multiline COMMIT_LOG for correct changelogs
- scope triggers to main pushes + PRs, add workflow_dispatch
- remove obsolete CircleCI config (no longer used)

* address review: least-privilege perms, decoupled recovery gates

- move contents/id-token write to the publish job; default read-only
- gate npm publish on npm version existence and GitHub release on
  release existence (decoupled), so reruns recover when a tag/release
  exists but the npm version is missing (the #196 failure mode),
  matching the pattern in pi-autoresearch/turbovector
- pin the release tag to the built commit (github.sha) instead of main
- scope pull_request trigger to main; add concurrency guard

* review: clarify package-metadata step quoting

Capture version/name into variables with single-quoted node -e args
instead of nested double quotes. Functionally equivalent (bash $()
handles nested quotes) but clearer and matches the pi-autoresearch idiom.

Author: a-tokyo

.circleci/config.yml

@@ -1,11 +1,19 @@
 name: Test Release Publish
 
-on: [push]
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
 
+# Least privilege by default; the publish job elevates for itself only.
 permissions:
-  contents: write
-  pull-requests: write
-  issues: write
+  contents: read
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   test:
@@ -20,15 +28,15 @@ jobs:
       - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ${{ steps.yarn-cache.outputs.dir }}
-          key: ubuntu-latest-node-20.18-yarn-${{ hashFiles('**/yarn.lock') }}
+          key: ubuntu-latest-node-24.x-yarn-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
-            ubuntu-latest-node-20.18-yarn-
+            ubuntu-latest-node-24.x-yarn-
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: '20.18'
+          node-version: '24.x'
           registry-url: https://registry.npmjs.org/
       - name: Install
-        run: yarn install
+        run: yarn install --frozen-lockfile
       - name: Test
         run: yarn test --ci --bail
       - name: Test TypeScript Type Definitions
@@ -41,42 +49,63 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     if: success() && github.ref == 'refs/heads/main'
+    permissions:
+      contents: write # create GitHub release + tag
+      id-token: write # OIDC token for npm trusted publishing
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - name: Get yarn cache
-        id: yarn-cache
-        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
-          path: ${{ steps.yarn-cache.outputs.dir }}
-          key: ubuntu-latest-node-20.18-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ubuntu-latest-node-20.18-yarn-
+          fetch-depth: 0 # full history so git describe/changelog works
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: '20.18'
+          node-version: '24.x' # ships npm >= 11.5.1, required for OIDC trusted publishing
           registry-url: https://registry.npmjs.org/
+          package-manager-cache: false # never cache in release builds
       - name: Install
-        run: yarn install
+        run: yarn install --frozen-lockfile
       - name: Build
         run: NODE_ENV=production yarn build
-      - name: Setup env vars
-        id: ownEnvVars
+      - name: Read package metadata
+        id: pkg
+        run: |
+          VERSION="$(node -p -e 'require("./package.json").version')"
+          NAME="$(node -p -e 'require("./package.json").name')"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+      - name: Build changelog
+        id: changelog
+        run: |
+          echo "body<<EOF" >> "$GITHUB_OUTPUT"
+          git log $(git describe --tags --abbrev=0 2>/dev/null || git rev-list --max-parents=0 HEAD)..HEAD --format='- %s (%an)' >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+      # Decoupled gates so a rerun recovers the exact failure in #196
+      # (release/tag exists but npm version is missing).
+      - name: Check if version already published to npm
+        id: check_npm
         run: |
-          # Set PACKAGE_VERSION
-          PACKAGE_VERSION=$(node -p -e "require('./package.json').version")
-          echo "PACKAGE_VERSION=$PACKAGE_VERSION" >> $GITHUB_ENV
-          # Set COMMIT_LOG
-          COMMIT_LOG=`git log $(git describe --tags --abbrev=0)..HEAD --format='%s - %an'`
-          echo "COMMIT_LOG=$COMMIT_LOG" >> $GITHUB_ENV
-      - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
+          if npm view "${{ steps.pkg.outputs.name }}@${{ steps.pkg.outputs.version }}" version >/dev/null 2>&1; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Check if GitHub release already exists
+        id: check_release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh release view "${{ steps.pkg.outputs.version }}" >/dev/null 2>&1; then
+            echo "create=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "create=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Create GitHub release
+        if: steps.check_release.outputs.create == 'true'
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1
         with:
-          # token: ${{ secrets.GITHUB_TOKEN }} # no need for personal token
-          tag: ${{ env.PACKAGE_VERSION }}
-          commit: main
-          body: ${{ env.COMMIT_LOG }}
+          tag: ${{ steps.pkg.outputs.version }}
+          commit: ${{ github.sha }} # pin the tag to the built commit, not the current tip of main
+          body: ${{ steps.changelog.outputs.body }}
       - name: npm publish
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        if: steps.check_npm.outputs.publish == 'true'
+        run: npm publish # OIDC trusted publishing — no NODE_AUTH_TOKEN needed