fix(release): use npm trusted publishing

[caio-pizzol]

What changed

• Grant the release job permission to request a GitHub OIDC token.
• Remove the long-lived npm token from the Changesets publish step.
• Pin every action in the OIDC-enabled job to an immutable commit SHA.

Why

@ooxml-dev/cli now trusts the superdoc/ooxml-dev release.yml workflow through npm Trusted Publishing. GitHub OIDC provides short-lived publish credentials, so the workflow no longer needs NPM_TOKEN.

Verified

• bun run check
• Workflow uses a GitHub-hosted runner
• Node 24 provides npm 11.17, above npm's 11.5.1 minimum for Trusted Publishing
• npm registry setup remains configured through actions/setup-node
• npm Trusted Publisher is configured for superdoc/ooxml-dev and release.yml
• Tokenless release run 31692011612 passed with all workflow actions pinned

The test run found no unpublished package, so npm did not perform an OIDC publish. The next new CLI version will be the first full Trusted Publishing test.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

---

View medium (1)

🟠 **Medium**

1. OIDC with mutable actions ✓ 🐞

Description

The release job now has id-token: write, so any action executed in this job can request an OIDC
token; because several steps still use mutable tag references (not commit SHAs), a
compromised/tag-updated action could run unreviewed code in the publish job and misuse OIDC-enabled
credentials (e.g., for package publishing, if the registry trusts this workflow identity).

Code

.github/workflows/release.yml[R12-14]

    permissions:
      contents: read
+      id-token: write

Relevance

●● Moderate

No close precedent on OIDC+unpinned actions; security hardening plausible but broad/subjective
workflow policy change.

PR-#17
PR-#18

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR adds OIDC capability via id-token: write in the job permissions, and the same job executes
multiple actions referenced by mutable tags rather than immutable commit SHAs.

.github/workflows/release.yml[12-15]
.github/workflows/release.yml[26-33]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The release job now grants `id-token: write`, which enables OIDC token minting inside the job. Since some actions are referenced by mutable tags, the job may execute different code over time without a PR review, increasing supply-chain risk in the publish pipeline.

### Issue Context
This workflow performs release/publish operations, so expanding auth capabilities should be paired with immutable action pinning (commit SHAs) and minimizing which steps/jobs can access OIDC.

### Fix Focus Areas
- .github/workflows/release.yml[12-15]
- .github/workflows/release.yml[26-33]

### Suggested fix
- Replace tag references like `actions/checkout@v6`, `actions/setup-node@v6`, and `oven-sh/setup-bun@v2` with commit-SHA pins (as already done for `changesets/action` and `actions/create-github-app-token`).
- Optionally split publishing into a dedicated job that has `id-token: write` and contains only the minimal, SHA-pinned steps required to publish.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

---

Context

✅ Compliance rules (platform): 11 rules

Review mode: ⚖️ Balanced: This is a localized workflow change, but it alters the release pipeline's pinned third-party action revisions and therefore warrants a careful review for release and supply-chain correctness.

---

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

---

Powered by Qodo

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[caio-pizzol]

Fixed in 301781a. The three remaining actions in the OIDC-enabled job are now pinned to the exact SHAs used by the verified run. Tokenless release run 31692011612 passed after the change.