[🔥AUDIT🔥] Fixes for publishing with OIDC

.github/workflows/changeset-release.yml

@@ -40,11 +40,19 @@ jobs:
         with:
           node-version: 20.x
 
+      - name: ⬆️ Upgrade npm for OIDC support
+        shell: bash
+        run: |
+          # npm trusted publishing requires npm CLI v11.5.1+
+          # Node.js 22 ships with npm 10.x, so we need to upgrade
+          npm install -g npm@latest
+          echo "✅ npm upgraded to $(npm --version)"
+
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
         with:
-          publish: yarn publish:ci
+          publish: npm publish:ci
         env:
           # We use a Personal Access Token here rather than the GITHUB_TOKEN
           # so that it will trigger our other actions. The token has to be on

package.json

@@ -1,6 +1,10 @@
 {
     "name": "@khanacademy/graphql-flow",
     "version": "3.4.2",
+    "publishConfig": {
+        "access": "public",
+        "provenance": true
+    },
     "bin": {
         "graphql-flow": "dist/cli/run.js"
     },