chore(publishing): use oidc

[avivkeller]

Ref: nodejs/admin#998

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
nodejs-org	Ready	Preview	Aug 17, 2025 7:20pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.21%. Comparing base (8ab9cea) to head (421e239).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8085      +/-   ##
==========================================
+ Coverage   73.20%   73.21%   +0.01%     
==========================================
  Files          97       97              
  Lines        8448     8448              
  Branches      227      227              
==========================================
+ Hits         6184     6185       +1     
+ Misses       2263     2262       -1     
  Partials        1        1              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[legendecas]

Created OIDC connections on workflow file publish-packages.yml for following packages:

• @node-core/ui-components
• @node-core/rehype-shiki
• @node-core/website-i18n

For @node-core/remark-lint referenced at nodejs/admin#1000, I will wait for more web-infra team +1 on the issue to proceed.

After this PR been landed, I will retire the NPM_TOKEN for nodejs.org repo.

[avivkeller]

cc @nodejs/web-infra to sign off

[bjohansebas]

LGTM

[MattIPv4]

Have we confirmed that pnpm publish works with OIDC in the same way as npm publish? I don't see anything in their docs at a quick glance to say it does, but also not sure if pnpm publish is just an alias to npm publish, or whether they do custom logic?

[avivkeller]

Have we confirmed that pnpm publish works with OIDC in the same way as npm publish? I don't see anything in their docs at a quick glance to say it does, but also not sure if pnpm publish is just an alias to npm publish, or whether they do custom logic?

From what I recall, pnpm's publish performs custom logic (regarding dependencies), and then calls npm's publish.

[github-actions]

Lighthouse Results

URL	Performance	Accessibility	Best Practices	SEO	Report
/en	🟢 99	🟢 100	🟢 100	🟢 100	🔗
/en/about	🟢 100	🟢 97	🟢 100	🟠 88	🔗
/en/about/previous-releases	🟢 100	🟢 93	🟢 100	🟠 89	🔗
/en/download	🟢 95	🟢 100	🟢 100	🟢 100	🔗
/en/blog	🟢 100	🟢 100	🟢 96	🟢 100	🔗

[avivkeller]

@legendecas i have removed the long lived token from the repository, feel free to retire it when ready