fix: npm provenance (#37)

Enable OIDC for trusted publishing and npm provenance.

Author: DoneDeal0

.github/workflows/cd.yml

@@ -9,8 +9,7 @@ on:
       - main
 
 jobs:
-  publish:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+  release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -30,14 +29,26 @@ jobs:
           node-version: "24"
           cache: "npm"
 
+      - name: Install npm 11 (required for OIDC) 
+        run: | 
+          corepack disable 
+          npm i -g npm@11 
+          echo "npm version: $(npm -v)"
+
       - name: Install dependencies
         run: npm ci
 
-      - name: Build the project
+      - name: Build
         run: npm run build
 
+      - name: Remove GitHub-injected npmrc (breaks OIDC)
+        run: | 
+          rm -f ~/.npmrc 
+          rm -f /home/runner/work/_temp/.npmrc || true
+
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_CONFIG_PROVENANCE: true
+          NPM_CONFIG_AUTH_TYPE: oidc
         run: npx semantic-release