docs(releasing): record that npm accepts immutable OIDC subject claim… #136

	name: Release

	on:
	push:
	branches: [main]

	# Publishes to npm via OIDC Trusted Publishing (`id-token: write` + a
	# per-package trusted-publisher config on npmjs.com — see docs/releasing.md;
	# a publish E404 means that config is missing for the package). NPM_TOKEN is
	# injected only as the fallback credential for packages without a trusted
	# publisher yet.
	permissions:
	contents: write
	pull-requests: write
	id-token: write

	concurrency: ${{ github.workflow }}-${{ github.ref }}

	jobs:
	release:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v7
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	# Matches the root package.json engines field (>=24). The bundled npm is
	# used as-is: node 24 ships npm >= 11.6.2 (>= 11.5.1 is what OIDC +
	# provenance needs), and upgrading to npm@latest on release day is how we
	# hit npm/cli#9722 (12.0.0 shipped without its bundled sigstore).
	- uses: actions/setup-node@v7
	with:
	node-version: 24
	registry-url: https://registry.npmjs.org
	- run: bun install --frozen-lockfile
	- name: Create Release PR or publish
	uses: changesets/action@v1
	with:
	# Opens/updates a "Version Packages" PR from pending changesets; when
	# that PR is merged, publishes the bumped packages.
	version: bun run version-packages
	publish: bun run release
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	NPM_CONFIG_PROVENANCE: "true"

Provide feedback