Chore: Migrate npm publish workflow to OIDC

[adamantmm]

Description

Switch npm publishing in .github/workflows/publish-npm.yml from NPM_TOKEN to Trusted Publishing (OIDC).

Trusted Publisher is already configured on npmjs.com for Adamant-im/adamant-tradebot and workflow file publish-npm.yml. This aligns the tradebot with adamant-api and adamant-console publish workflows.

Related issue

Closes #119

Changes

• Remove NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} from the publish step
• Node.js 24 + npm install -g npm@latest for OIDC-compatible npm CLI
• Add workflow_dispatch trigger for manual publish verification
• Add release tag ↔ package.json version guard on release events
• Add workflow header comments documenting Trusted Publisher setup
• Set publishConfig.provenance: true in package.json

Breaking changes

No runtime or user-facing breaking changes. CI-only change.

How to test

1. Merge to dev, then master
2. Optionally run Publish npm package via workflow_dispatch on master (dry run not available — use a patch release or test on next tag)
3. On next release (v9.0.1 or later), confirm:
   • Workflow succeeds without NPM_TOKEN
   • npm shows publisher GitHub Actions with provenance badge
4. Revoke NPM_TOKEN secret after successful OIDC publish

Notes for reviewers

• id-token: write was already present; this PR removes the token fallback path
• Docker publish workflow is unchanged
• v9.0.0 was published with token; OIDC applies from the next release onward

Checklist

• Code is formatted
• Tests added/updated (if needed)
• Documentation updated (if needed)
• Changes tested in all relevant environments (verify on next release)

[Copilot]

Pull request overview

This PR migrates the npm publishing workflow from using a repository-stored NPM_TOKEN to npm Trusted Publishing via GitHub Actions OIDC, aligning the repo’s release process with sibling projects and enabling provenance.

Changes:

• Switch .github/workflows/publish-npm.yml to OIDC-based publishing (no NODE_AUTH_TOKEN) and add a manual workflow_dispatch trigger.
• Upgrade the publishing workflow to Node.js 24, update npm during the job, and add a release-tag ↔ package.json version guard for release events.
• Enable npm provenance by default via publishConfig.provenance: true in package.json.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/publish-npm.yml	Updates the publish workflow to use OIDC Trusted Publishing, adds manual trigger, and introduces release/version guards.
package.json	Enables provenance on publish via publishConfig.provenance.

Comments suppressed due to low confidence (1)

.github/workflows/publish-npm.yml:25

• workflow_dispatch can publish from any user-selected ref (including feature branches), which makes it easy to accidentally publish an unintended build. If manual publishing is only meant for verification on master (or tags), add a job-level guard so the job only runs for releases, or for dispatches from allowed refs.

jobs:
  publish:
    runs-on: ubuntu-latest

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[al-onyxprotocol]

looks good