Hardening npm Publishing with Trusted Publishing — Tokenless OIDC, Staged Publishing, and PR-Merge Releases

After the 2025-2026 npm supply-chain attacks, publishing with a long-lived token is no longer the default. Authenticate with GitHub Actions OIDC Trusted Publishing so there is no publish secret, make CI capable of only staging a package, and keep live promotion as a separate npm MFA step. Restrict the release Environment to the PR merge ref, and automate even the release PR itself. The result is a multi-boundary defense where repository write access alone cannot produce a live npm package.

Keyless-Signing CLI Artifacts with Sigstore cosign — GitHub Actions OIDC, Bundle Verification, and a Tamper Test

The weakness of out-of-band distribution is that nobody can confirm the artifact they received actually came from that org's workflow and was not modified along the way. Sigstore cosign keyless signing lets you sign artifacts with a GitHub Actions OIDC identity, holding no long-lived signing key. Fulcio issues a short-lived certificate and the signing event lands in a transparency log. By pinning the certificate identity and OIDC issuer, verifiers can confirm that this repository's workflow signed it. We assemble a recipe end to end that signs both the npm .tgz and the Google Drive zip, with a tamper test wired into CI so verification provably fails on modified bytes.