ci: migrate npm release to OIDC trusted publishing with provenance

[jaredwray]

Summary

Migrates the release pipeline from a long-lived NPM_TOKEN secret to GitHub Actions OIDC trusted publishing, and enables npm provenance attestations for every published package. Everything stays on pnpm — no npm/npx invocations are introduced.

The repo already pins pnpm@11.1.2 via packageManager + corepack. pnpm's native publish flow (since 11.0) handles the OIDC token exchange and provenance itself using bundled libnpmpublish, so no system npm upgrade is required.

Changes

.github/workflows/release.yaml

• Added id-token: write permission so the job can mint the OIDC token npm exchanges for a short-lived publish credential.
• Removed the env: NPM_TOKEN and the hand-written ~/.npmrc step — no static token is needed anymore.
• Publish step is now just pnpm publish:packages.

packages/*/package.json (all 5 packages)

• Added --provenance to each build:publish script (pnpm publish --provenance --access public --no-git-checks).
• Added a repository field with a monorepo directory to the redis, rabbitmq, nats, and zeromq providers, and a directory to qified. npm provenance requires a public repository that matches the source it is published from, so the providers (which had no repository field) would have failed provenance generation without this.

⚠️ One-time setup required before the next release

OIDC trusted publishing won't authenticate until a trusted publisher is configured on npmjs.com for each package (qified, @qified/redis, @qified/rabbitmq, @qified/nats, @qified/zeromq). On each package's npm settings page → Trusted Publishers, add a GitHub Actions publisher with (case-sensitive):

Field	Value
Organization / user	jaredwray
Repository	qified
Workflow filename	release.yaml
Environment	(leave blank — none configured)

Once configured, the NPM_TOKEN repo secret can be deleted. Trusted publishing requires a cloud-hosted runner (ubuntu-latest ✓) and public repo for provenance to be emitted — both already satisfied.

Verification

• All 5 package.json files validated as parseable JSON; repository/build:publish fields confirmed correct.
• Confirmed the pinned pnpm 11.1.2 resolves via corepack and accepts --provenance (a deliberately bogus flag is rejected with Unknown option, while --provenance passes), and that provenance is a recognized pnpm config key.
• Verified the workflow no longer references any secrets.*/NODE_AUTH_TOKEN/.npmrc.

Note: pnpm test exercises only src//test/ TypeScript (Biome is scoped to those globs) and the provider suites require Docker services; this change is release-pipeline + package.json metadata only and does not touch source or tests.

https://claude.ai/code/session_015xP5N3Wz14pL14dc3pyYsg

---

Generated by Claude Code

[gemini-code-assist]

Code Review

This pull request updates the package.json files for several packages (nats, qified, rabbitmq, redis, and zeromq) by adding the --provenance flag to the publishing script and specifying the repository details along with their respective directories. There are no review comments, and I have no feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (dfbc414) to head (e7a4c4f).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #203   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           10        10           
  Lines         1392      1392           
  Branches       247       248    +1     
=========================================
  Hits          1392      1392           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.