Give up and use NPM_TOKEN

Author: dzucconi

.github/workflows/publish.yml

@@ -15,7 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      id-token: write
 
     steps:
       - name: Resolve tag to publish
@@ -71,8 +70,10 @@ jobs:
             echo "already_published=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - run: npm publish --provenance --access public
+      - run: npm publish --access public
         if: steps.npm_state.outputs.already_published != 'true'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Ensure GitHub Release exists
         env:

RELEASE.md

@@ -5,7 +5,7 @@ Use this checklist to cut a new npm release for `@aredotna/cli`.
 Publishing is automated by GitHub Actions when a PR with a release label is merged to `main`.
 Use exactly one label on the PR: `major`, `minor`, or `patch`.
 The `Release` workflow bumps the version and pushes the release commit and tag.
-That tag then triggers the `Publish` workflow, which publishes to npm with trusted publishing (OIDC) and creates the GitHub Release.
+That tag then triggers the `Publish` workflow, which publishes to npm using the `NPM_TOKEN` GitHub secret and creates the GitHub Release.
 
 ## 1) Preflight
 
@@ -75,7 +75,7 @@ arena whoami --json
 
 ## Troubleshooting
 
-- Publish job fails with OIDC/trusted publishing error: verify trusted publisher settings on npm exactly match `aredotna/cli` and workflow file `publish.yml`.
+- Publish job fails with npm auth error (401/404): verify the `NPM_TOKEN` repository secret exists and has permission to publish `@aredotna/cli`.
 - Workflow skips publishing: merged PR did not contain one of `major`, `minor`, or `patch` labels.
 - Workflow fails with multiple release labels: keep exactly one of `major|minor|patch` on the PR.
 - Release job says `main` advanced after the PR merged: re-run the `Release` workflow manually after reviewing current `main`.