From 84e6ce372ee5b0d0004b6da65957dddea649b797 Mon Sep 17 00:00:00 2001
From: Zixuan Chen <remch183@outlook.com>
Date: Wed, 5 Nov 2025 22:03:34 +0800
Subject: [PATCH 1/2] chore: remove npm provenance metadata

---
 .github/workflows/release-please.yml | 6 ++++--
 README.md                            | 5 +++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index af5b856..32b0577 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -9,6 +9,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release:
@@ -29,6 +30,9 @@ jobs:
     needs: release
     if: ${{ needs.release.outputs.releases_created }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -52,8 +56,6 @@ jobs:
         run: pnpm -r build
 
       - name: Publish changed packages to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           set -euo pipefail
           echo "Finding unpublished workspace packages..."
diff --git a/README.md b/README.md
index e96b87b..cd421df 100644
--- a/README.md
+++ b/README.md
@@ -174,6 +174,11 @@ See `protocol.md` for the full description and error codes.
 
 Node 18+ is required for local development.
 
+## Publishing & Releases
+
+- Releases are automated with the `release-please` workflow. Merge the release PR generated by the bot to tag new versions.
+- The publish job uses npm's [trusted publisher](https://docs.npmjs.com/trusted-publishers) integration. The GitHub Actions workflow requests an OIDC token, so no long-lived `NPM_TOKEN` secret is required.
+
 ## Licensing
 
 - `loro-protocol`: MIT

From 66752e8df9c5a7b78e91e9041f3115a5a79b77d0 Mon Sep 17 00:00:00 2001
From: Zixuan Chen <remch183@outlook.com>
Date: Wed, 5 Nov 2025 22:11:58 +0800
Subject: [PATCH 2/2] ci: use node v24

---
 .github/workflows/ci.yml             | 2 +-
 .github/workflows/release-please.yml | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 04e6b89..d100ad8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 10
       
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 32b0577..467b938 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -45,9 +45,9 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'pnpm'
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          cache: "pnpm"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -85,4 +85,3 @@ jobs:
           # Publish only the unpublished ones in topo order
           echo "Publishing: $filters"
           pnpm -r $filters publish --access public --no-git-checks
-