chore(ci): Disable NPM tokens in release workflow

[jhampton]

Comment out NODE_AUTH_TOKEN and NPM_TOKEN for security during migration to NPM OIDC-based publishing authentication

Description

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation update
• refactor: Code refactoring (no functional changes)
• perf: Performance improvement
• test: Test additions or updates
• build: Build system or dependency changes
• ci: CI configuration changes
• chore: Other changes (maintenance, etc.)

Breaking Changes

• This PR contains BREAKING CHANGES

Breaking Change Details:

Migration Guide:

Checklist

• My code follows the project's code style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• All commit messages follow conventional commits format
• I have updated the appropriate section in documentation (if needed)

Conventional Commits

✅ All commits in this PR follow conventional commit format:

<type>(<scope>): <subject>

[optional body]

[optional footer]

Example commit messages:

• feat(api): add Bible verse lookup method
• fix(auth): resolve token refresh race condition
• docs: update installation instructions

For breaking changes:

• feat(api)!: redesign Bible content API

See CONTRIBUTING.md for detailed guidelines.

Related Issues

Closes #
Relates to #

Additional Context

Reviewer Notes

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[greptile-apps]

Greptile Summary

This PR disables NPM token-based authentication in the release workflow by commenting out NODE_AUTH_TOKEN and NPM_TOKEN environment variables. The change supports migration to NPM OIDC-based publishing authentication, which is a more secure approach than storing long-lived tokens as GitHub secrets. The workflow already has the necessary OIDC configuration in place (id-token: write permission for npm provenance), so removing these token-based credentials is a straightforward security improvement that should not impact the release process if NPM OIDC is properly configured in the NPM registry settings.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk - it removes deprecated authentication credentials and relies on OIDC which is more secure.
• The change is minimal and focused - only commenting out two lines that set NPM authentication tokens. The workflow infrastructure already has OIDC support configured (id-token: write permission and registry-url setup), so the removal of these tokens is aligned with modern security best practices. Semantic-release and npm have native OIDC support, so authentication should work properly without the explicit token variables. The change reduces security risk by eliminating long-lived token storage in GitHub secrets.
• No files require special attention

Important Files Changed

Filename

Overview

.github/workflows/release.yml

Disabled NPM token environment variables (NODE_AUTH_TOKEN and NPM_TOKEN) in the release workflow by commenting them out on lines 50-51. This change is part of a migration to NPM OIDC-based publishing authentication, which uses the id-token: write permission (line 18) instead of long-lived tokens. The change is safe and aligns with the existing workflow configuration that already supports OIDC (provenance token permission is present).

Sequence Diagram

sequenceDiagram
    participant GitHub as GitHub Actions
    participant Checkout as Checkout Code
    participant NodeSetup as Setup Node/NPM
    participant Validate as Validate
    participant Release as semantic-release
    participant NPM as NPM Registry
    participant OIDC as GitHub OIDC Provider

    GitHub->>Checkout: Fetch repository (SSH key)
    GitHub->>NodeSetup: Configure npm registry
    NodeSetup->>NodeSetup: Configure registry-url
    GitHub->>Validate: Run typecheck/lint/test/build
    Validate-->>GitHub: All checks pass
    GitHub->>Release: Run semantic-release
    Release->>Release: Check version, generate changelog
    Release->>NPM: Request OIDC token from GitHub
    Release->>OIDC: Get short-lived OIDC token
    OIDC-->>Release: Return token (id-token permission)
    Release->>NPM: Publish package with OIDC token
    NPM-->>Release: Package published
    Release->>GitHub: Create release and git tags
    Release-->>GitHub: Complete

Loading

[greptile-apps]

Greptile's behavior is changing!

From now on, if a review finishes with no comments, we will not post an additional "statistics" comment to confirm that our review found nothing to comment on. However, you can confirm that we reviewed your changes in the status check section.

_{This feature can be toggled off in your Code Review Settings by deselecting "Create a status check for each PR".}

[github-actions]

🎉 This PR is included in version 0.8.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀