Chore/release

[tnkshuuhei]

• https://github.blog/changelog/2025-12-09-npm-classic-tokens-revoked-session-based-auth-and-cli-token-management-now-available/#what-you-need-to-do
• https://docs.npmjs.com/trusted-publishers#supported-cicd-providers

[claude]

Code review

I've found 2 issues that need to be addressed:

1. Node.js version conflicts with CLAUDE.md documentation

File: .github/workflows/release.yml line 24

The PR changes Node.js from version 22 to 24, but CLAUDE.md line 106 explicitly documents the runtime as "Bun + Node.js 22.x":

- **Runtime**: Bun + Node.js 22.x

Impact: This creates a documentation inconsistency. If Node.js 24 is required for OIDC support, CLAUDE.md should be updated to reflect the new runtime requirement.

Location:

evidence/.github/workflows/release.yml

Lines 21 to 25 in a0afa03

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "24"
	registry-url: "https://registry.npmjs.org"

---

2. Missing NODE_AUTH_TOKEN workaround for npm OIDC authentication

File: .github/workflows/release.yml lines 45-46

The PR removes NODE_AUTH_TOKEN to enable OIDC Trusted Publishing, but the changesets/action@v1 has a known bug where it appends undefined to the .npmrc file when NODE_AUTH_TOKEN is not provided, breaking npm authentication.

The issue: See changesets/action#542 and PR #545 - the fix is not yet merged into v1.

Required workaround: Until the fix is released, you need to set NODE_AUTH_TOKEN: '' (empty string) in the env block to prevent the undefined token from being injected.

Suggested fix:

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  NODE_AUTH_TOKEN: ''

Location:

evidence/.github/workflows/release.yml

Lines 36 to 46 in a0afa03

	- name: Create Release Pull Request or Publish
	id: changesets
	uses: changesets/action@v1
	with:
	publish: npm publish --access public --provenance
	version: bunx changeset version
	title: "chore: version packages"
	commit: "chore: version packages"
	createGithubReleases: true
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

---

Summary:

• 1 CLAUDE.md compliance issue (Node.js version documentation)
• 1 bug (missing npm OIDC workaround)