ci: bootstrap CHIRP npm trust

[ty-everett]

Program and scope

• Tracker or issue: CHIRP first publication and NanoStore rollout
• Program gate(s) advanced: first npm package record, protected provenance publication, and OIDC trusted-publisher bootstrap
• Why this change is needed: npm rejected the first @bsv/chirp@0.1.0 PUT because a package record must exist before trusted publishing can be configured.
• Explicitly out of scope: package bytes, public API, UHRP/CHIRP wire behavior, container images, and deployed NanoStore behavior.
• Exact head SHA reviewed: 8a4420490f764bf185b882cf69d1eaa24dd2cc4d

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected package: the already-reviewed @bsv/chirp@0.1.0 tarball only. The temporary lane can run only as a manual single release filtered to ./packages/network/chirp.

Verification

• Local commands and results: Node 24; frozen lifecycle-disabled install; repository health 184/184; focused package/repository-health 30/30; full build; typecheck; lint; format; audit security (zero ungoverned high/critical findings); bash syntax; git diff --check.
• Hosted CI run: pending for this exact head.
• Conformance evidence: not selected because no protocol source, vectors, or conformance inputs changed.
• Coverage delta: no production source changed.
• Lint/typecheck delta: local lint and post-build full typecheck passed.
• Browser/mobile/packed-consumer evidence: unchanged package bytes; the protected release repeats the complete package, browser/mobile, packed-consumer, scan, attestation, and integrity gates.
• Performance or bundle-size delta: none; no runtime artifact changed.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings (including accepted or false-positive issue states) and zero unreviewed hotspots; Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date, and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

The granular token expires in one day, can write only the @bsv scope, has no organization administration permission, and is exposed only to the protected publish job. The prepare/build job remains uncredentialed. The release plan rejects bootstrap use unless the event is manual, mode is single, and the exact filter is ./packages/network/chirp.

Dependency evidence

• Release notes and necessity: no dependency change.
• Runtime, build, and peer compatibility: no runtime or package bytes changed.
• Deduplicated lockfile: unchanged.
• Audit and CodeQL: local governed audit passed; hosted CodeQL pending.
• Package and consumer tests: protected release repeats exact-tarball build, pack, consumer, browser/mobile, SBOM, Trivy, attestation, provenance, and registry-integrity verification.
• Bundle and performance impact: none.
• Affected public package versions: @bsv/chirp@0.1.0 only.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

After publication, configure the bsv-blockchain/ts-stack release.yaml publisher with environment npm-production, verify registry provenance/integrity and consumer install/CLI behavior, delete the environment secret, revoke the npm token, and immediately merge a cleanup PR that removes this lane and governed exception while retaining the corrected CHIRP trust helper.

Completion evidence

• The linked tracker is updated only for work fully proved by merged code, passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is being handed to another contributor as “complete”
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud