fix: npm provenance (#37)

Enable OIDC for trusted publishing and npm provenance.

Author: DoneDeal0

.github/workflows/cd.yml

@@ -1,16 +1,12 @@
 name: CD Pipeline
 
 on:
-  workflow_run:
-    workflows: ["CI Pipeline"]
-    types:
-      - completed
+  pull_request:
     branches:
       - main
 
 jobs:
   publish:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -28,6 +24,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "24"
+          registry-url: "https://registry.npmjs.org"
           cache: "npm"
 
       - name: Install dependencies
@@ -36,6 +33,17 @@ jobs:
       - name: Build the project
         run: npm run build
 
+      - name: Upgrade npm for OIDC trusted publishing
+        run: npm i -g npm@^11.7.0
+      - name: Debug npm
+        run: |
+          node -v
+          npm -v
+          npm config ls -l
+          npm config get auth-type || true
+          echo '--- .npmrc ---'
+          test -f ~/.npmrc && sed -n '1,200p' ~/.npmrc || echo 'no ~/.npmrc'
+
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -20,6 +20,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "24"
+          registry-url: "https://registry.npmjs.org"
           cache: "npm"
 
       - name: Install dependencies