chore: npm Trusted Publishing + 0.7.1 republish

.github/workflows/publish.yml

@@ -59,10 +59,11 @@ jobs:
             fs.writeFileSync('release-notes.md', lines.slice(start + 1, end).join('\n').trim() + '\n');
           "
 
+      # Auth is npm Trusted Publishing (OIDC): the registry trusts this
+      # repo + workflow file via `id-token: write` above, so no NPM_TOKEN.
+      # A token in NODE_AUTH_TOKEN would take precedence and bypass OIDC.
       - name: Publish package
         run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create GitHub Release (creates the tag on workflow_dispatch)
         uses: softprops/action-gh-release@v3

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.7.1 (2026-11-09)
+
+Republish — no code changes. npm releases now go through Trusted Publishing
+(OIDC from `publish.yml`) instead of a long-lived token; this version is the
+one that validates the connection.
+/ 재배포 — 코드 무변경. npm 발행이 토큰 대신 Trusted Publishing(OIDC)으로
+전환되었고, 이 버전이 그 연결을 검증합니다.
+
 ## 0.7.0 (2026-11-08)
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devslab/numkey",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "publishConfig": {
     "access": "public"
   },