chore(ci): Migrate to npm trusted publishing (#531)

.github/workflows/release.yaml

@@ -2,7 +2,7 @@ name: Prebuild
 
 on:
   push:
-    branches: [main, fix/download-version]
+    branches: [main, fix/use-trusted-publishing]
     tags:
       - "v*"
   pull_request:
@@ -16,6 +16,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
+      id-token: write
     strategy:
       matrix:
         include:
@@ -362,7 +363,7 @@ jobs:
     name: Release
     needs: [build-nvim, build-c, build-mcp]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/download-version' || startsWith(github.ref, 'refs/tags/v'))
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/use-trusted-publishing' || startsWith(github.ref, 'refs/tags/v'))
     permissions:
       contents: write
     steps:
@@ -469,10 +470,14 @@ jobs:
     name: Publish Rust crates
     needs: [build-nvim, build-c, build-mcp]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/download-version' || startsWith(github.ref, 'refs/tags/v'))
-
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/use-trusted-publishing' || startsWith(github.ref, 'refs/tags/v'))
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v5
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
 
       - name: Install Lua
         uses: leafo/gh-actions-lua@v12
@@ -489,16 +494,17 @@ jobs:
 
       - name: Publish crates
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         run: make publish-crates V="${{ steps.version.outputs.version }}"
 
   npm-publish:
     name: Publish npm packages
     needs: [build-c]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/download-version' || startsWith(github.ref, 'refs/tags/v'))
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/use-trusted-publishing' || startsWith(github.ref, 'refs/tags/v'))
     permissions:
       contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v5
 
@@ -522,8 +528,6 @@ jobs:
           path: ./npm-packages
 
       - name: Publish platform packages
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           TAG="${{ steps.version.outputs.npm_tag }}"
@@ -536,14 +540,12 @@ jobs:
               make set-npm-version PKG="$pkg_dir" VERSION="$VERSION"
 
               cd "$pkg_dir"
-              npm publish --tag "$TAG" --access public || echo "Failed to publish ${pkg_name} (may already exist)"
+              npm publish --tag "$TAG" --access public --provenance
               cd -
             fi
           done
 
       - name: Publish bun package
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           TAG="${{ steps.version.outputs.npm_tag }}"
@@ -552,11 +554,9 @@ jobs:
           make set-npm-version PKG=packages/fff-bun VERSION="$VERSION"
 
           cd packages/fff-bun
-          npm publish --tag "$TAG" --access public || echo "Failed to publish @ff-labs/fff-bun (may already exist)"
+          npm publish --tag "$TAG" --access public --provenance
 
       - name: Publish Node.js package
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           TAG="${{ steps.version.outputs.npm_tag }}"
@@ -567,11 +567,9 @@ jobs:
           cd packages/fff-node
           npm install
           npm run build
-          npm publish --tag "$TAG" --access public || echo "Failed to publish @ff-labs/fff-node (may already exist)"
+          npm publish --tag "$TAG" --access public --provenance
 
       - name: Publish pi-fff package
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           VERSION="${{ steps.version.outputs.version }}"
           TAG="${{ steps.version.outputs.npm_tag }}"
@@ -580,4 +578,4 @@ jobs:
           make set-npm-version PKG=packages/pi-fff VERSION="$VERSION"
 
           cd packages/pi-fff
-          npm publish --tag "$TAG" --access public || echo "Failed to publish @ff-labs/pi-fff (may already exist)"
+          npm publish --tag "$TAG" --access public --provenance

packages/fff-bin-darwin-arm64/package.json

@@ -12,7 +12,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-bin-darwin-arm64"
   }
 }

packages/fff-bin-darwin-x64/package.json

@@ -12,7 +12,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-bin-darwin-x64"
   }
 }

packages/fff-bin-linux-arm64-gnu/package.json

@@ -12,7 +12,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-bin-linux-arm64-gnu"
   },
   "libc": ["glibc"]

packages/fff-bin-linux-arm64-musl/package.json

@@ -12,7 +12,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-bin-linux-arm64-musl"
   },
   "libc": ["musl"]

packages/fff-bin-linux-x64-gnu/package.json

@@ -12,7 +12,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-bin-linux-x64-gnu"
   },
   "libc": ["glibc"]

packages/fff-bin-linux-x64-musl/package.json

@@ -12,7 +12,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-bin-linux-x64-musl"
   },
   "libc": ["musl"]

packages/fff-bin-win32-arm64/package.json

@@ -12,7 +12,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-bin-win32-arm64"
   }
 }

packages/fff-bin-win32-x64/package.json

@@ -12,7 +12,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-bin-win32-x64"
   }
 }

packages/fff-bun/package.json

@@ -39,7 +39,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff"
   },
   "keywords": [
@@ -58,9 +58,9 @@
     "access": "public"
   },
   "bugs": {
-    "url": "https://github.com/dmtrKovalenko/fff.nvim/issues"
+    "url": "https://github.com/dmtrKovalenko/fff/issues"
   },
-  "homepage": "https://github.com/dmtrKovalenko/fff.nvim#readme",
+  "homepage": "https://github.com/dmtrKovalenko/fff#readme",
   "optionalDependencies": {
     "@ff-labs/fff-bin-darwin-arm64": "0.0.0",
     "@ff-labs/fff-bin-darwin-x64": "0.0.0",

packages/fff-node/package.json

@@ -34,7 +34,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/fff-node"
   },
   "keywords": [
@@ -53,9 +53,9 @@
     "access": "public"
   },
   "bugs": {
-    "url": "https://github.com/dmtrKovalenko/fff.nvim/issues"
+    "url": "https://github.com/dmtrKovalenko/fff/issues"
   },
-  "homepage": "https://github.com/dmtrKovalenko/fff.nvim#readme",
+  "homepage": "https://github.com/dmtrKovalenko/fff#readme",
   "dependencies": {
     "ffi-rs": "^1.0.0"
   },

packages/pi-fff/package.json

@@ -7,12 +7,12 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/dmtrKovalenko/fff.nvim.git",
+    "url": "git+https://github.com/dmtrKovalenko/fff.git",
     "directory": "packages/pi-fff"
   },
-  "homepage": "https://github.com/dmtrKovalenko/fff.nvim/tree/main/packages/pi-fff",
+  "homepage": "https://github.com/dmtrKovalenko/fff/tree/main/packages/pi-fff",
   "bugs": {
-    "url": "https://github.com/dmtrKovalenko/fff.nvim/issues"
+    "url": "https://github.com/dmtrKovalenko/fff/issues"
   },
   "keywords": [
     "pi",