ci(release): fix npm publish via OIDC trusted publishing

[sergak01]

Summary

Fix the v0.18.3 production release publish failure (E404 on npm publish) by aligning .github/workflows/release.yml with the npm Trusted Publisher configuration (mi-examples/pp-dev + release.yml).

Changes

• Add id-token: write permission for GitHub OIDC
• Remove legacy NODE_AUTH_TOKEN / secrets.NPM_TOKEN from the publish step
• Upgrade npm to latest before publish (required for OIDC trusted publishing)

After merge

1. Delete the remote tag v0.18.3
2. Recreate and push v0.18.3 from main so release.yml runs with OIDC auth

Test plan

• Merge to main
• Delete and recreate tag v0.18.3
• Verify Production Release workflow publishes @metricinsights/pp-dev@0.18.3 successfully

Summary by CodeRabbit

• Chores
  • Updated release workflow configuration and build process.

Note: This release contains no user-visible changes. Updates are internal to the build and publishing infrastructure.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8beea51c-4ee2-4406-91fd-30b9a4869006

📥 Commits

Reviewing files that changed from the base of the PR and between 0141932 and 024405f.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The release workflow is updated to enable OIDC-style trusted publishing by granting the id-token write permission and upgrading npm to the latest version before publishing to npm.

Changes

Release Workflow OIDC Trusted Publishing

Layer / File(s)	Summary
OIDC permissions and npm upgrade for publish .github/workflows/release.yml	Workflow permissions grants id-token: write for OIDC trust, and a new step installs latest npm globally before the publish step.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A workflow now trusts without secrets to spare,
OIDC whispers through the GitHub air,
npm gets refreshed, shiny and new,
Publishing safely—that's what we do! 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: enabling OIDC trusted publishing for npm releases in the CI workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pp-3487

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}