From 510987e8e453ded35e57bfe978a61772092461ff Mon Sep 17 00:00:00 2001
From: Goon <duy@wearetopgroup.com>
Date: Fri, 7 Aug 2026 13:00:13 +0700
Subject: [PATCH 1/3] ci: switch npm publish to trusted publishing (OIDC)

- Drop NPM_TOKEN from the semantic-release env; npm CLI 11.5.1+ picks
  up the GitHub Actions OIDC token automatically and exchanges it for
  a short-lived publish credential when a Trusted Publisher is
  configured on npmjs.com for the package.
- Pin `npm install -g npm@latest` (Node 22 image ships npm 10.x, which
  predates OIDC support).
- Enable NPM_CONFIG_PROVENANCE so the published tarball carries a
  sigstore provenance attestation.

Requires (one-time, on npmjs.com):
  Package agentbrain -> Settings -> Trusted publishers ->
  Add GitHub Actions publisher:
    Repository owner: nextlevelbuilder
    Repository name:  agentbrain-cli
    Workflow:         release.yml
    Environment:      (leave blank)

After this PR merges, the NPM_TOKEN repo secret can be deleted.
---
 .github/workflows/release.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a89b672..136acaa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,10 +44,17 @@ jobs:
           node-version: 22
           cache: pnpm
           registry-url: https://registry.npmjs.org
+      # npm CLI >= 11.5.1 detects the GitHub Actions OIDC token via
+      # ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN and, when a matching Trusted
+      # Publisher is configured for the package on npmjs.com, exchanges it
+      # for a short-lived publish credential — no NPM_TOKEN needed. The Node
+      # 22 image ships npm 10.x, so pin a newer one here.
+      - run: npm install -g npm@latest
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
       - name: semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # Attach sigstore provenance to the published tarball.
+          NPM_CONFIG_PROVENANCE: "true"
         run: npx semantic-release

From da2e2854f988006266f8ec8f0535fc52795bb310 Mon Sep 17 00:00:00 2001
From: Goon <duy@wearetopgroup.com>
Date: Fri, 7 Aug 2026 13:06:00 +0700
Subject: [PATCH 2/3] chore(release): 1.0.0 for initial npm publish

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index bfe929f..6bfebac 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "agentbrain",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "CLI for AgentBrain enterprise data hub - interact with organizations, connectors, knowledge bases, and workflows",
   "type": "module",
   "bin": {

From 38256b2ba70a890cc2c03e3eda3b250b671d6fbe Mon Sep 17 00:00:00 2001
From: Goon <duy@wearetopgroup.com>
Date: Fri, 7 Aug 2026 13:27:37 +0700
Subject: [PATCH 3/3] chore(release): rename package to agentbrain-cli

npm blocked "agentbrain" (E403, name too similar to existing "agent-brain").
Renamed to "agentbrain-cli" and manually published 1.0.0 to reserve the name.

CLI binary command remains `agentbrain` (unchanged in bin field).
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 6bfebac..a1d0b91 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "agentbrain",
+  "name": "agentbrain-cli",
   "version": "1.0.0",
   "description": "CLI for AgentBrain enterprise data hub - interact with organizations, connectors, knowledge bases, and workflows",
   "type": "module",