[waleedlatif1]

Summary

The four npm publish workflows (sim, sim-setup, simstudio, simstudio-ts-sdk) authenticate with npm trusted publishing instead of the long-lived NPM_TOKEN secret. The runner's OIDC token is exchanged for a short-lived npm credential at publish time, so no npm credential is stored anywhere, and every release now carries a provenance attestation.

• OIDC: each publish job requests id-token: write and runs Node 24, whose bundled npm 11 is the minimum trusted publishing supports.
• sim and sim-setup publish the tarball they smoke-tested. npm publish replaces bun publish, since npm's CLI is what performs the OIDC exchange. bun pm pack still builds the tarball, because it rewrites workspace: ranges. That one tarball is smoke-tested on Node 20, then published as is, and npm runs no lifecycle scripts for a tarball, so nothing is rebuilt between test and publish. The smoke tests now also check that --version reports the bumped release version.
• sim-setup republishes when its own workflow changes, as sim already does.
• simstudio gets a repository field. Provenance requires it to match this repo.
• The setup action drops its registry-url input. It existed only to wire NODE_AUTH_TOKEN into an .npmrc.

Merge order

Merge only after each package has a trusted publisher configured on npmjs.com (repository simstudioai/sim, the workflow file below, npm publish allowed). Merged earlier, every publish fails.

Package	Workflow
simstudio	publish-cli.yml
sim	publish-sim-cli.yml
sim-setup	publish-sim-setup.yml
simstudio-ts-sdk	publish-ts-sdk.yml

Once all four have published through OIDC, the NPM_TOKEN secret is removed, and each package is set to disallow token publishing.

Testing

• Built sim and sim-setup locally, packed each with a preview version, and ran the workflows' smoke checks against the tarball: version match, the full sim-setup command --help sweep, and no repository source directories in the tarball.
• npm publish <tarball> --dry-run resolved the right name, version, tag and access for both.
• The packed manifests contain no workspace: ranges.
• actionlint reports nothing new.
• The real proof is the first publish of each package after merge, which I'll watch.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Nov 7, 2026 10:03pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The code appears safe to merge once the four npm trusted publishers are configured as described.

Summary

The four npm workflows now separate building from publishing.

• Four npm packages now publish through GitHub's short-lived access.
• Changes to the sim-setup publishing workflow now trigger its release flow.
• The simstudio package now names its source repository.

No new actionable issues were found. This review checked the code; it did not run a live publish.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Push to release branch] --> B[Build package]
  B --> C[Pack tarball]
  C --> D[Smoke-test sim and sim-setup]
  C --> E[Upload tarball]
  D --> E
  E --> F[GitHub-hosted publish job]
  F --> G[Publish through npm OIDC]
  G --> H[SDK GitHub release]

Loading

_{Reviews (3) · Last reviewed commit: "ci(npm): publish from a GitHub-hosted jo..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}