fix: switch npm publish from NPM_TOKEN to OIDC trusted publishing

Removes the manual NPM_TOKEN auth in release.yml — npm publish now
authenticates via GitHub Actions OIDC identity, which is already
configured for all four published packages. This eliminates the
need to manage and rotate an npm automation token.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: CI Bot

.github/workflows/release.yml

@@ -291,8 +291,8 @@ jobs:
     
     - name: Publish to npm (workspaces)
       run: |
-        # Authenticate npm
-        npm config set //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+        # Auth via OIDC trusted publishing (id-token: write + setup-node registry-url)
+        # No NPM_TOKEN needed — GitHub Actions identity is verified by npm directly
 
         # Publish packages in dependency order if the target version does NOT yet exist
         # --provenance adds signed build attestation (requires id-token: write)
@@ -319,8 +319,6 @@ jobs:
         else
           npm publish -w @debugmcp/mcp-debugger --access public --provenance --tag ${NPM_TAG}
         fi
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   create-release:
     name: Create GitHub Release

docs/release-checklist.md

@@ -5,7 +5,7 @@ Pre-release validation for mcp-debugger. Run `npm run release:dry-run` to automa
 ## Before Tagging
 
 ### Automated (via `npm run release:dry-run`)
-- [ ] Package versions match (the dry-run script checks root plus the packages listed in its `PUBLISHED_PKGS`; adapter-go, adapter-java, and adapter-dotnet may not be included in the automated check yet)
+- [ ] Package versions match (the dry-run script checks root plus all workspace packages including adapter-dotnet)
 - [ ] `CHANGELOG.md` has `[x.y.z] - YYYY-MM-DD` entry with date
 - [ ] `CHANGELOG.md` has empty `[Unreleased]` section at top
 - [ ] `npm run build` succeeds
@@ -16,7 +16,7 @@ Pre-release validation for mcp-debugger. Run `npm run release:dry-run` to automa
 - [ ] `release.yml` changelog extraction strips `v` prefix (`refs/tags/v}` not `refs/tags/}`)
 
 ### Manual
-- [ ] **npm trusted publishing configured** — each `@debugmcp/*` package must have trusted publishing enabled at npmjs.com → package Settings → Configure Trusted Publishing (repo: `debugmcp/mcp-debugger`, workflow: `release.yml`). Note: the release dry-run script still checks for `NPM_TOKEN` as a repository secret.
+- [ ] **npm trusted publishing configured** — each published `@debugmcp/*` package must have trusted publishing enabled at npmjs.com → package Settings → Configure Trusted Publishing (repo: `debugmcp/mcp-debugger`, workflow: `release.yml`). npm auth is via OIDC — no `NPM_TOKEN` secret needed.
 - [ ] **Docker Hub credentials** — `DOCKER_USERNAME` and `DOCKER_PASSWORD` secrets are current
 - [ ] **PyPI token** — `PYPI_TOKEN` secret is current
 - [ ] `release.yml` default ref updated to current tag (for workflow_dispatch reruns)

scripts/release-dry-run.sh

@@ -102,22 +102,15 @@ for pkg_dir in "${PUBLISHED_PKGS[@]}"; do
   fi
 done
 
-# --- 6. Check npm token and GitHub secrets ---
+# --- 6. Check GitHub secrets (npm uses OIDC trusted publishing, no token needed) ---
 echo ""
-echo "── npm authentication ──"
-
-# Test local npm login
-if npm whoami > /dev/null 2>&1; then
-  NPM_USER=$(npm whoami)
-  pass "Local npm login: $NPM_USER"
-else
-  warn "Not logged in to npm locally"
-fi
+echo "── Publishing credentials ──"
+echo "  npm: OIDC trusted publishing (no token needed)"
 
 if command -v gh > /dev/null 2>&1; then
-  # Check secrets exist
+  # Check secrets exist (npm uses OIDC, only Docker and PyPI need tokens)
   SECRETS_LIST=$(gh secret list 2>/dev/null || echo "")
-  for secret in NPM_TOKEN DOCKER_USERNAME DOCKER_PASSWORD PYPI_TOKEN; do
+  for secret in DOCKER_USERNAME DOCKER_PASSWORD PYPI_TOKEN; do
     if echo "$SECRETS_LIST" | grep -q "^${secret}"; then
       pass "GitHub secret $secret exists"
     else