[lastlink]

Summary

• publish.yaml authenticates to npm through GitHub OIDC (id-token: write), so the NPM_TOKEN secret and its check are removed
• The publish job uses Node 24 and installs npm >= 11.5.1, which trusted publishing needs
• Provenance is still added automatically only for public repos

One-time npm setup

On npmjs.com: package > Settings > Trusted Publisher > GitHub Actions, with owner lastlink, repository multi-assert, workflow filename publish.yaml. The package must already exist, so a first version may need a local npm publish --access public.

Test plan

• CI passes
• Dry-run dispatch of the publish workflow passes after merge

[github-actions]

unit test report

29 tests  ±0   29 ✅ ±0   0s ⏱️ ±0s
 2 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 521463e. ± Comparison against base commit 8596814.