ci: promote over Trusted Publishing, and close the release there

[twk3]

Promoting 2.7.0 to latest failed with 401 Unauthorized - PUT /-/package/@currents%2fmcp/dist-tags/latest. Promotion was the last workflow still holding an NPM_TOKEN: publishing moved to Trusted Publishing, which never reads that secret, so nothing exercised it until the tag had to move. After this, no workflow in the repo references NPM_TOKEN.

Promote authenticates over OIDC

npm authorizes dist-tag over OIDC from 11.21.0 (npm/cli#10038, merged 2026-09-30). The runner's bundled npm is older, so the job upgrades npm and then asserts the version, failing with a readable message rather than inside the registry call.

This needs a setting on npm that a workflow cannot set. Trusted publishing grants dist-tag separately from publish, and the grant is off by default, including for existing configurations (GitHub changelog) — so the configuration that published the 2.7.0 beta will still refuse the tag until Allow npm dist-tag is enabled on it. That is already done for @currents/mcp. The dist-tag failure path names the setting, so the next person who hits it on another package is not debugging a bare 401.

Promoting closes the release

The Linear-complete and Slack steps only ran from a latest publish. The documented flow is publish beta → test → promote, which never reaches that path, so promoting left the release open in Linear and silent in Slack — as it did for 2.7.0. They now run from promote as well. Both paths keep them: a version reaches latest by one route or the other, never both.

Two latent bugs found while in here

• Promote checked out github.event.pull_request.head.sha, which is empty on a workflow_dispatch, so it silently took the default branch. Harmless for dist-tag, which reads no tree, but it is copied from publish.yaml where it matters. The npm ci step installed dependencies npm dist-tag does not use, and is dropped.
• The latest channel guard accepted refs/tags/release/*, which release-it cannot produce — .release-it.json sets tagName: "v${version}". Only the branch arm could ever match, so running Publish from the v2.7.0 tag failed a guard that looked like it should have passed. The guard now names branches only and says why a tag does not match.

Not changed

.github/workflows/*.yaml does not satisfy Prettier today and the repo's format script covers only src and skills, so I left formatting alone rather than mix a reformat into this diff.

Verification

YAML parses and the step list is as intended; the version comparison was checked for equal, higher and lower npm versions. The OIDC exchange itself only exercises on a real dispatch — the first run of promote after this merges is the test.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y4EZAEvxLfXuMeNz5ZgCMz

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[baz-reviewer]

Baz Summary

Promote npm releases through Trusted Publishing with OIDC by upgrading and validating npm, removing the obsolete NPM_TOKEN dependency, and improving dist-tag failure guidance. Complete the release in Linear and announce it in Slack after either promotion or latest-channel publishing, while correcting release-ref validation and documenting the flow.

Topics

Topic	Details
Trusted promotion	Authenticate promotion through npm Trusted Publishing, remove unnecessary checkout and dependency installation, and provide actionable errors for missing dist-tag permissions. Modified files (2) .github/workflows/promote.yaml RELEASE.md Latest Contributors(2) User Commit Date noreply@anthropic.com ci: pin the npm that h... October 14, 2026 gimenez.maxi@gmail.com chore: add slack notif... May 28, 2026
Release completion	Complete Linear releases and post Slack announcements after promotion or direct latest publishing, while restricting latest-channel validation to supported release/* branches. Modified files (3) .github/workflows/promote.yaml .github/workflows/publish.yaml RELEASE.md Latest Contributors(2) User Commit Date noreply@anthropic.com ci: pin the npm that h... October 14, 2026 agoldis@gmail.com ci: add skip_deploy in... August 16, 2026

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}