- Remove NPM_TOKEN / NODE_AUTH_TOKEN — publish now uses OIDC trusted
publishing (no secrets needed)
- Add workflow_dispatch trigger with prerelease checkbox: publishes to
alpha dist-tag so we can verify OIDC works without touching latest
- Drop --provenance flag (included automatically with trusted publishing)
The release event path still publishes to latest as before; the only
change is the auth mechanism.
To test: bump version to x.y.z-alpha.0 on a branch, then run workflow
with prerelease checked.
This shows `npx` commands instead of `npm i` in PR preview comments,
which is more appropriate for this CLI tool.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
* Potential fix for code scanning alert no. 1: Workflow does not contain permissions
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* lint
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
