chore: remove npm provenance metadata

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 9
+          version: 10
 
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4

.github/workflows/release-please.yml

@@ -9,6 +9,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release:
@@ -29,6 +30,9 @@ jobs:
     needs: release
     if: ${{ needs.release.outputs.releases_created }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -41,9 +45,9 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'pnpm'
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          cache: "pnpm"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -52,8 +56,6 @@ jobs:
         run: pnpm -r build
 
       - name: Publish changed packages to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           set -euo pipefail
           echo "Finding unpublished workspace packages..."
@@ -83,4 +85,3 @@ jobs:
           # Publish only the unpublished ones in topo order
           echo "Publishing: $filters"
           pnpm -r $filters publish --access public --no-git-checks
-

README.md

@@ -174,6 +174,11 @@ See `protocol.md` for the full description and error codes.
 
 Node 18+ is required for local development.
 
+## Publishing & Releases
+
+- Releases are automated with the `release-please` workflow. Merge the release PR generated by the bot to tag new versions.
+- The publish job uses npm's [trusted publisher](https://docs.npmjs.com/trusted-publishers) integration. The GitHub Actions workflow requests an OIDC token, so no long-lived `NPM_TOKEN` secret is required.
+
 ## Licensing
 
 - `loro-protocol`: MIT