secure-publish-setuplisted

# Skill: secure-publish-setup Replaces long-lived registry tokens with **OIDC trusted publishing** ([GA since 2025-07-31](https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/)): the workflow proves its identity to npm via a short-lived OIDC token, npm accepts the publish without any `NPM_TOKEN`, and automatically attaches **provenance attestations** (cryptographic proof of source repo + build). Reference implementation: [Miragon/wardley-maps-modeler](https://github.com/Miragon/wardley-maps-modeler) (`publish-npm-package.yml`). Run this when asked to set up secure/tokenless npm publishing, or as the publishing slice of a release/supply-chain audit (see the sibling skill **`release-audit`**). Typically chained after **`release-please-setup`** (`if: releases_created == 'true'`). ## Phase 1 — Check preconditions - [ ] npm CLI **≥ 11.5.1** and Node **≥ 22.14** in the publish job (`actions/setup-node` with `node-version: 24` covers both) - [ ] **GitHub-hosted runners** — self-hosted runners are not supported for trusted publishing - [ ] Provenance requires a **public repo** — for private repos, trusted publishing still works but publish with `--provenance=false` - [ ] The package already exists on npm, or do the very first publish manually (a trusted publisher is configured per existing package) If any of these fail, report it and agree on a fallback with the user (e.g. granular automation token in a protected environment) instead o