fix: switch to npm Trusted Publishing with OIDC

- Update all package.json publish-npm scripts to use `npm publish --provenance`
- Add `id-token: write` permission to workflow for OIDC authentication
- Remove NPM_TOKEN-based authentication (no longer needed with Trusted Publishing)
- Remove npmrc setup step (OIDC handles auth automatically)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: roderik

.github/workflows/qa.yml

@@ -23,6 +23,7 @@ permissions:
   contents: read
   pull-requests: write
   packages: write
+  id-token: write
 
 concurrency:
   group:
@@ -47,13 +48,13 @@ jobs:
       security-events: write
       actions: read
       packages: write
+      id-token: write
     env:
       SLACK_BOT_TOKEN: ""
       SLACK_CHANNEL_ID: ""
       HARBOR_USER: ""
       HARBOR_PASS: ""
       PAT_TOKEN: ""
-      NPM_TOKEN: ""
       TAG: ""
       VERSION: ""
       CONSOLE_GRAPHQL: ""
@@ -80,7 +81,6 @@ jobs:
           HARBOR_USER: op://platform/harbor/username
           HARBOR_PASS: op://platform/harbor/password
           PAT_TOKEN: op://platform/github-commit-pat/credential
-          NPM_TOKEN: op://platform/npmjs/credential
 
       # Label QA as running and notify Slack (only for non-draft PRs)
       - name: Label QA as running
@@ -118,7 +118,6 @@ jobs:
         uses: settlemint/shared-actions/.github/actions/setup-dependencies@main
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          npm_token: ${{ env.NPM_TOKEN }}
           disable_node: "true"
 
       - name: Inject slug/short variables
@@ -182,12 +181,6 @@ jobs:
 
           echo "Updated version to $VERSION"
 
-      - name: Login to npm
-        if: github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'release'
-        run: |
-          echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" >> ~/.npmrc
-          echo "//registry.npmjs.org/:_authToken=${{ env.NPM_TOKEN }}" >> ~/.npmrc
-
       - name: Setup git user
         run: |
           git config --global user.name "$(git --no-pager log --format=format:'%an' -n 1)"

sdk/blockscout/package.json

@@ -47,7 +47,7 @@
     "test": "bun test",
     "test:coverage": "bun test --coverage",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "prepack": "cp ../../LICENSE .",
     "docs": "typedoc --options '../../typedoc.config.mjs' --entryPoints src/blockscout.ts --out ./docs"
   },

sdk/cli/package.json

@@ -38,7 +38,7 @@
     "test": "bun test",
     "test:coverage": "bun test --coverage",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "docs": "bun scripts/create-docs.ts",
     "prepack": "cp ../../LICENSE ."
   },

sdk/eas/package.json

@@ -45,7 +45,7 @@
     "publint": "publint run --strict",
     "attw": "attw --pack .",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "prepack": "cp ../../LICENSE .",
     "codegen": "gql-tada generate-output",
     "docs": "typedoc --options '../../typedoc.config.mjs' --entryPoints src/eas.ts --out ./docs"

sdk/hasura/package.json

@@ -57,7 +57,7 @@
     "test": "bun test",
     "test:coverage": "bun test --coverage",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "prepack": "cp ../../LICENSE .",
     "docs": "typedoc --options '../../typedoc.config.mjs' --entryPoints src/hasura.ts src/postgres.ts --out ./docs"
   },

sdk/ipfs/package.json

@@ -47,7 +47,7 @@
     "test": "bun test",
     "test:coverage": "bun test --coverage",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "prepack": "cp ../../LICENSE .",
     "docs": "typedoc --options '../../typedoc.config.mjs' --entryPoints src/ipfs.ts --out ./docs"
   },

sdk/js/package.json

@@ -48,7 +48,7 @@
     "test": "bun test",
     "test:coverage": "bun test --coverage",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "prepack": "cp ../../LICENSE .",
     "docs": "typedoc --options '../../typedoc.config.mjs' --entryPoints src/settlemint.ts --out ./docs"
   },

sdk/mcp/package.json

@@ -36,7 +36,7 @@
     "build": "bun run build.ts",
     "dev": "tsdown --watch ./src",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "prepack": "cp ../../LICENSE ."
   },
   "dependencies": {

sdk/minio/package.json

@@ -47,7 +47,7 @@
     "test": "bun test",
     "test:coverage": "bun test --coverage",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "prepack": "cp ../../LICENSE .",
     "docs": "typedoc --options '../../typedoc.config.mjs' --entryPoints src/minio.ts --out ./docs"
   },

sdk/next/package.json

@@ -67,7 +67,7 @@
     "test": "bun test",
     "test:coverage": "bun test --coverage",
     "typecheck": "tsc --noEmit",
-    "publish-npm": "bun publish --tag ${TAG} --access public || exit 0",
+    "publish-npm": "npm publish --provenance --tag ${TAG} --access public || exit 0",
     "prepack": "cp ../../LICENSE .",
     "docs": "typedoc --options '../../typedoc.config.mjs' --entryPoints src/components/test.tsx src/config/with-settlemint.ts --out ./docs"
   },