Fix npm trusted publishing workflows

.github/workflows/publish-cli.yml

@@ -36,7 +36,8 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .node-version
+          node-version: 24
+          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -55,7 +56,7 @@ jobs:
 
       - name: Publish dev package to npm
         working-directory: packages/cli
-        run: pnpm publish --access public --tag dev --provenance --no-git-checks
+        run: npm publish --access public --tag dev --provenance
 
       - name: Summarize dev publish
         run: |
@@ -93,7 +94,8 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .node-version
+          node-version: 24
+          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -137,7 +139,7 @@ jobs:
       - name: Publish official package to npm
         if: ${{ !inputs.dry_run }}
         working-directory: packages/cli
-        run: pnpm publish --access public --tag latest --provenance --no-git-checks
+        run: npm publish --access public --tag latest --provenance
 
       - name: Create release tag
         if: ${{ !inputs.dry_run }}

.github/workflows/publish-compute.yml

@@ -36,7 +36,8 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .node-version
+          node-version: 24
+          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -55,7 +56,7 @@ jobs:
 
       - name: Publish dev package to npm
         working-directory: packages/compute
-        run: pnpm publish --access public --tag dev --provenance --no-git-checks
+        run: npm publish --access public --tag dev --provenance
 
       - name: Summarize dev publish
         run: |
@@ -93,7 +94,8 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .node-version
+          node-version: 24
+          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -137,7 +139,7 @@ jobs:
       - name: Publish official package to npm
         if: ${{ !inputs.dry_run }}
         working-directory: packages/compute
-        run: pnpm publish --access public --tag latest --provenance --no-git-checks
+        run: npm publish --access public --tag latest --provenance
 
       - name: Create release tag
         if: ${{ !inputs.dry_run }}

AGENTS.md

@@ -14,6 +14,7 @@ Use this file for repo-wide instructions. Use package-local `AGENTS.md` files fo
 ## Package Manager
 
 - Use `pnpm` for commands run inside this repo.
+- Exception: use `npm publish` for npm release workflow publish steps so npm trusted publishing can use its OIDC authentication flow.
 - Use `npm` or multiple package-manager examples in user-facing content.
 
 ## Pre-Commit Verification

docs/architecture/adrs/0001-preview-package-and-publishing.md

@@ -37,7 +37,7 @@ The publish workflow is prepared for npm trusted publishing with provenance.
 Official releases publish with:
 
 ```bash
-pnpm publish --access public --tag latest --provenance
+npm publish --access public --tag latest --provenance
 ```
 
 Local development should build and inspect the package, but should not publish it.