ci: revert to OIDC trusted publisher (now configured on npm) #3

	name: Publish to npm

	# Tag v* ⇒ npm publish via npm Trusted Publishing (OIDC).
	#
	# Auth model: package "call2me-sdk" on npmjs.com has GitHub Actions
	# trusted publisher configured for THIS repo + workflow + env. No
	# NPM_TOKEN is needed; npm exchanges the GitHub-issued OIDC ID token
	# for a short-lived publish token at request time.
	#
	# Configure at:
	# npmjs.com → call2me-sdk → Settings → Trusted Publisher
	# Repository: call2me-app/node-sdk
	# Workflow: publish.yml
	# Environment: npm

	on:
	push:
	tags: ["v*"]
	workflow_dispatch:

	permissions:
	id-token: write
	contents: read

	jobs:
	publish:
	runs-on: ubuntu-latest
	environment:
	name: npm
	url: https://www.npmjs.com/package/call2me-sdk
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: "20"
	registry-url: "https://registry.npmjs.org"
	- name: Verify tag matches package.json
	run: \|
	PV=$(node -p "require('./package.json').version")
	TV="${GITHUB_REF_NAME#v}"
	[ "$PV" = "$TV" ] \|\| { echo "package.json $PV != tag $TV"; exit 1; }
	- name: Publish (OIDC trusted publisher + provenance)
	run: npm publish --provenance --access public

Provide feedback