Removes the two long-lived secrets from the release pipeline.

npm: NPM_TOKEN → Trusted Publishing (OIDC)

• Drop the hand-written ~/.npmrc step and NPM_TOKEN from both publish steps.
• Publish authenticates via npm Trusted Publishing. The job already declared id-token: write, and the trusted publisher for @ladle/react is configured on npmjs.com (repo tajo/ladle + this workflow file).
• Add registry-url and a npm install -g npm@latest step — OIDC needs npm ≥ 11.5.1 and the runner's bundled npm can be older. (changeset publish and publish-next.js both shell out to the system npm.)
• Provenance attestations are now generated automatically.

git: GIT_DEPLOY_KEY PAT → GitHub App token

• Replace the personal PAT with a scoped, short-lived installation token via actions/create-github-app-token@v3, passed to both checkout and changesets/action.
• App-token pushes still trigger downstream workflows, so merging the "Version Packages" PR keeps re-triggering the release (the reason the custom PAT existed).

Secrets

• Added: RELEASE_BOT_APP_ID, RELEASE_BOT_PRIVATE_KEY (already configured).
• To revoke after the first successful run: NPM_TOKEN (also revoke on npmjs.com) and GIT_DEPLOY_KEY (also delete the PAT).

Rollout / verification

After merge, watch the first release run and confirm:

• npm publish succeeds via OIDC (provenance shown in the log)
• the App token opens/updates the Version Packages PR and pushes tags

Only then revoke NPM_TOKEN / GIT_DEPLOY_KEY — there is no token fallback left in the workflow, so keep them until the first run is green.

Also incidentally resolves the stale node-version concern: the job runs on 24.x (≥ 22.14 required by OIDC, and satisfies root engines.node >=22.12.0).

🤖 Generated with Claude Code