NODE_AUTH_TOKEN expired (set 90 days ago, the npm token default
expiry) causing all publish runs to fail with 'PUT 404 Not Found'
since 2026-04-30.
Migrate publish.yml and publish-platform.yml to npm Trusted
Publishing (OIDC) so we no longer depend on long-lived secrets:
- Bump actions/setup-node v4 -> v6 (improves OIDC compatibility)
- Add 'npm install -g npm@latest' to guarantee npm CLI >= 11.5.1
(the minimum required for trusted publishing).
- Drop NODE_AUTH_TOKEN env from every publish step. The npm CLI
picks up the GitHub Actions OIDC token automatically.
- Keep --provenance / NPM_CONFIG_PROVENANCE=true (real-world
reports indicate provenance is not auto-emitted yet).
Per-package trusted publisher must still be configured on
npmjs.com (Settings -> Trusted Publisher) for all 24 packages
(oh-my-opencode + oh-my-openagent main + 11 platform packages
each, dual-published) before the next publish run.
YeonGyu-Kim
48fc7bd459