chore: publish to npm via trusted publishing (OIDC)

Author: luwes

.github/workflows/cd.yml

@@ -47,22 +47,30 @@ jobs:
           config-file: .github/release-please/release-please-config.json
           manifest-file: .github/release-please/.release-please-manifest.json
 
+      # Publish when release-please cuts a new release, or when the workflow is
+      # run manually to retry a release whose npm publish failed. publish-packages
+      # skips any version already on the registry, so a manual run is a safe no-op
+      # when everything is already published.
+      - id: should_publish
+        run: echo "result=${{ steps.release.outputs.releases_created == 'true' || github.event_name == 'workflow_dispatch' }}" >> "$GITHUB_OUTPUT"
+
       - uses: actions/checkout@v4
-        # these if statements ensure that a publication only occurs when
-        # a new release is created:
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        if: ${{ steps.should_publish.outputs.result == 'true' }}
 
+      # No registry-url here on purpose: it makes setup-node write an .npmrc with
+      # `_authToken=${NODE_AUTH_TOKEN}` plus a placeholder token, which npm falls
+      # back to and fails with a misleading E404 when OIDC is not accepted.
+      # Publishing authenticates via trusted publishing (OIDC) instead.
       - uses: actions/setup-node@v4
         with:
           node-version: 24
-          registry-url: 'https://registry.npmjs.org'
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        if: ${{ steps.should_publish.outputs.result == 'true' }}
 
       - run: npm ci
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        if: ${{ steps.should_publish.outputs.result == 'true' }}
 
       - run: npm run build
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        if: ${{ steps.should_publish.outputs.result == 'true' }}
 
       - run: npm exec -c publish-packages
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        if: ${{ steps.should_publish.outputs.result == 'true' }}