feat: migrate npm-release.yml to OIDC trusted publishing

.github/workflows/npm-release.yml

@@ -17,7 +17,7 @@ jobs:
     permissions:
       contents: write      # push version commits, create GitHub releases
       pull-requests: write # create/update the "[ci] release" PR
-      id-token: write      # OIDC for npm provenance attestation
+      id-token: write      # OIDC for npm trusted publishing AND provenance attestation
     steps:
       - name: Checkout the repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -37,6 +37,12 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Test OIDC Token
+        run: |
+          TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=npm" | jq -r '.value')
+          [ -n "$TOKEN" ] && echo "✅ OIDC working" || exit 1
+
       - name: Build
         run: pnpm run build
 
@@ -70,6 +76,6 @@ jobs:
           # scoped to this repo only (contents:write, pull-requests:write),
           # rotated every 2 hours via github-actions-access-provider.
           GITHUB_TOKEN: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # Empty NPM_TOKEN forces npm to fall through to OIDC token exchange.
+          NPM_TOKEN: ''
           NPM_CONFIG_PROVENANCE: true

package.json

@@ -12,7 +12,10 @@
   ],
   "description": "BuyButton.js allows merchants to build Shopify interfaces into any website",
   "main": "lib/buybutton.umd.js",
-  "repository": "git@github.com:Shopify/buy-button-js.git",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/buy-button-js.git"
+  },
   "publishConfig": {
     "access": "public",
     "@shopify:registry": "https://registry.npmjs.org/",