fix(ci): explicit --provenance + ensure npm >= 11.5.1

[charfeng1]

Last run on master (after #8 merged) failed with ENEEDAUTH. OIDC env vars are available but npm isn't engaging them.

Two likely causes addressed:

1. Node 24's bundled npm may be < 11.5.1 (trusted publishing minimum). Add an explicit npm install -g --force npm@latest step. --force avoids the promise-retry self-upgrade bug we hit earlier (only triggered when in-place upgrading on top of a much older npm, which we no longer have on Node 24).
2. npm may need explicit --provenance flag to engage OIDC trusted publishing, even though docs claim auto-detect.

Adds a debug npm --version print so we can see what version was on the runner if this still fails. Once it works, that debug step can be dropped.

Summary by CodeRabbit

Release Notes

• Chores
  • Improved npm publishing workflow with enhanced version management
  • Package provenance attestation now included with published releases

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release workflow's publish job now ensures npm version >= 11.5.1 before publishing, adding a diagnostic step and forced upgrade. The npm publish command includes a --provenance flag to generate provenance attestation alongside the --access public setting.

Changes

npm trusted publishing with provenance

Layer / File(s)	Summary
npm upgrade and provenance flags .github/workflows/release.yml	Pre-publish steps print the current npm version and forcibly upgrade npm to the latest version. The publish command adds --provenance to enable provenance attestation during npm publish.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• charfeng1/opencode-ralph-loop#7: Both PRs modify the same .github/workflows/release.yml publish job to adjust Node/npm setup for OIDC trusted publishing, though with different approaches to npm version management.
• charfeng1/opencode-ralph-loop#8: Both PRs modify the same .github/workflows/release.yml publish job to adjust npm publishing configuration for OIDC trusted publishing.

Poem

🐰 A hop, a pip, npm takes flight,
With provenance shining oh so bright!
Version bumped to meet the trust,
OIDC attestations a publish must!
Rabbit blesses artifacts with care. ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and specifically addresses the two main changes: adding explicit --provenance flag and ensuring npm >= 11.5.1 for OIDC trusted publishing compatibility.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci-explicit-provenance

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/release.yml (1)

90-94: ⚡ Quick win

Pin npm to npm@^11.5.1 instead of npm@latest.

Using npm@latest makes the release pipeline vulnerable to unexpected failures when a future major npm version changes Node compatibility or CLI behavior. The workflow currently uses Node 24, which is compatible with npm 11.5.1 and later versions in the npm 11.x range (all versions 11.0.0–11.14.1 require node: ^20.17.0 || >=22.9.0). Pinning to npm@^11.5.1 keeps CI deterministic and ensures the pipeline remains predictable across releases, while still satisfying trusted publishing requirements.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 90 - 94, Replace the workflow
step labeled "Ensure npm >= 11.5.1" that currently runs "npm install -g --force
npm@latest && npm --version" with a pinned install of the npm 11.x range (e.g.,
"npm install -g --force npm@^11.5.1 && npm --version") so the job uses a
deterministic npm release; update the run command in that step to install
npm@^11.5.1 instead of npm@latest.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/release.yml:
- Around line 90-94: Replace the workflow step labeled "Ensure npm >= 11.5.1"
that currently runs "npm install -g --force npm@latest && npm --version" with a
pinned install of the npm 11.x range (e.g., "npm install -g --force npm@^11.5.1
&& npm --version") so the job uses a deterministic npm release; update the run
command in that step to install npm@^11.5.1 instead of npm@latest.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9b59d77f-aa88-49e8-a328-67e067de9e02

📥 Commits

Reviewing files that changed from the base of the PR and between dd16563 and 9438d34.

📒 Files selected for processing (1)

• .github/workflows/release.yml