[kylemcd]

Description

Moves npm publishing to trusted publishing (OIDC), so CI no longer needs NPM_TOKEN. npm stops direct publishes from 2FA-bypass tokens in January 2027. Part of KNO-16634, for KNO-16635.

Workflow (release.yml)

• Grants id-token: write to the release job only, which Yarn needs for the OIDC exchange and provenance. The workflow-level contents: read from main stays as is.
• Removes the npm token, the "Set NPM Auth" step, and setup-node's registry-url. Yarn uses npmAuthToken ahead of OIDC when one is set, and registry-url injects a placeholder token.
• Runs the job in the production-release environment. npm's trusted publisher config can't check the branch, so this environment's branch policy decides which branches can publish (main, canary, rc).

Yarn 4.9.1 → 4.18.1

• Yarn publishes through OIDC natively from 4.10.3 (scoped packages).
• npmMinimalAgeGate: 0 keeps the pre-4.15 install behavior.
• npmPublishRegistry publishes to registry.npmjs.org, not the yarnpkg alias.
• yarn.lock changes are metadata only (format version and the resolve patch hash).

Publishing

• release:publish adds --provenance (Yarn doesn't turn it on automatically) and --tolerate-republish.
• Before it builds, it fails when a package isn't on npm yet, because npm can't publish a package's first version through trusted publishing. The error names the command to run.
• Every package's repository field now points at this repo with its directory. npm checks it against the workflow. types, eslint-config, and typescript-config had none.

yarn release:bootstrap (new, scripts/npm-trusted-publishing.mjs)

• Adds the trusted publisher config (npm trust github ... --env production-release --allow-publish) for every package, or for the ones you name.
• For a package name that isn't on npm yet, it first publishes a 0.0.0 placeholder so the name exists.
• --dry-run prints the npm commands without running them. RELEASES.md documents it.

Reviewers can skip .yarn/releases/. It's the vendored Yarn binary.

Todos

• Restrict the production-release environment to main, canary, and rc, with admin bypass off.
• Protect rc. The only ruleset targets the default branch.
• After this merges and the Version PR opens, run yarn release:bootstrap, then merge the Version PR within 2 days. npm drops a new config that hasn't published by then.
• Keep NPM_TOKEN until canary merges main. Canary still authenticates with npmAuthToken. Remove it after that (KNO-16640).

Checklist

• Tests have been added for new features or major refactors to existing features.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
javascript-ms-teams-connect-example	Ready	Preview	Nov 6, 2026 5:41pm UTC
javascript-nextjs-example	Ready	Preview	Nov 6, 2026 5:41pm UTC
javascript-slack-connect-example	Ready	Preview	Nov 6, 2026 5:41pm UTC
javascript-slack-kit-example	Ready	Preview	Nov 6, 2026 5:41pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 6307642

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages

Name	Type
@knocklabs/client	Patch
@knocklabs/eslint-config	Patch
@knocklabs/expo	Patch
@knocklabs/prettier-config	Patch
@knocklabs/react	Patch
@knocklabs/react-core	Patch
@knocklabs/react-native	Patch
@knocklabs/types	Patch
@knocklabs/typescript-config	Patch
nextjs-app-dir-example	Patch
ms-teams-connect-example	Patch
slack-connect-example	Patch
slack-kit-example	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[linear-code]

KNO-16635

KNO-16634

[cursor]

Not approved: this is a release-pipeline and publishing change, not an auto-release, dependency, or docs-only PR, so it needs product-team review. Human review is needed; requested @connorlindsey (in addition to the existing request for @cjbell).

  

_{Sent by Cursor Approval Agent: SDK approver}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.48%. Comparing base (92ad6b6) to head (6307642).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1107   +/-   ##
=======================================
  Coverage   78.48%   78.48%           
=======================================
  Files         140      140           
  Lines        4508     4508           
  Branches     1314     1314           
=======================================
  Hits         3538     3538           
  Misses        873      873           
  Partials       97       97