This PR adds support for npm's OIDC-based trusted publishing, which lets you publish packages without managing long-lived NPM tokens.

What this addresses

Closes #542 and helps with #515 by enabling OIDC in the current workflow model. Related to #545 but takes a more comprehensive approach.

Changes

Added a new oidcAuth input parameter (defaults to false for backward compatibility). When enabled, the action validates your OIDC environment before trying to publish:

• Checks you're running npm 11.5.1+ (requirement for OIDC)
• Verifies id-token: write permission is set
• Detects if you accidentally left NPM_TOKEN set (conflicting auth)

The implementation explicitly passes OIDC environment variables to the publish command. This is necessary because some toolchains spawn fresh shell processes, and we need to ensure the OIDC tokens reach npm even through those layers.

Testing

I've been testing this in production at Adobe (spectrum-design-data repo) and added comprehensive test coverage:

• 9 unit tests for OIDC validation logic
• 13 integration tests for authentication setup
• Automated test workflow with 4 different scenarios

All 30 tests pass locally.

How to use it

permissions:
  contents: write
  pull-requests: write
  id-token: write  # This is the key addition

jobs:
  release:
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - run: npm install -g npm@latest  # Get npm 11.5.1+

      - uses: changesets/action@v1
        with:
          publish: yarn release
          oidcAuth: true  # Enable OIDC
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # No NPM_TOKEN needed!

You'll also need to configure trusted publishing on npmjs.com for your packages (one-time setup).

Why this approach vs PR #545

PR #545 just prevents writing undefined to .npmrc, but doesn't validate the environment or provide any feedback when things are misconfigured. This implementation validates upfront and gives you clear error messages if something's wrong, which saves a lot of debugging time.

Backward compatibility

Fully backward compatible - existing workflows using NPM_TOKEN continue to work unchanged. OIDC is opt-in via the new parameter.