chore: upgrade CI to Node 24 and migrate npm publishing to OIDC

[BlobMaster41]

Warning

This PR is required to comply with npm's new security standard. npm deprecated all classic tokens on December 9, 2025 and now mandates OIDC Trusted Publishing for CI/CD workflows.

This PR is required by #2976.

Changes proposed in this pull request:

⯈ Upgrade GitHub Actions to v6 and Node.js 24

• Node.js 20 reaches end-of-life in April 2026
• Updated actions/checkout from v4 to v6
• Updated actions/setup-node from v4 to v6
• Updated actions/github-script from v7 to v8 (uses Node 24 runtime)
• All workflows now use node-version: current to target Node 24
• Added explicit node-version: current to the features job which was missing it

⯈ Migrate npm publishing to OIDC Trusted Publishing

• npm deprecated all classic tokens on December 9, 2025
• Removed NPM_TOKEN environment variable
• Authentication now uses OpenID Connect with short-lived, cryptographically-signed credentials
• Provenance attestations are generated automatically by npm
• Added id-token: write permission required for OIDC
• Added registry-url to setup-node for npm authentication
• Eliminates token management overhead and improves supply chain security

⯈ Add prerelease support and GitHub Release automation

• Publish workflow now detects alpha, beta, rc versions and tags them appropriately on npm
• Creates GitHub Releases automatically after successful publish (tag is created by the release action)
• Generates changelogs from merged PRs using mikepenz/release-changelog-builder-action@v6
• Prereleases are marked correctly on both npm and GitHub

Migration steps required before merging:

1. Configure Trusted Publisher on npmjs.com for each package:

   • Navigate to package settings → Trusted Publisher section
   • Select GitHub Actions as provider
   • Enter: Organization AssemblyScript, Repository assemblyscript, Workflow publish.yml
   • Repeat for @assemblyscript/loader and @assemblyscript/rtrace
   • Why: npm needs to know which GitHub workflow is authorized to publish without a token. Without this, the OIDC authentication will fail with a 404 error.

2. Remove NPM_TOKEN from repository secrets

   • Why: OIDC authentication only works when no auth token is present. If NODE_AUTH_TOKEN is set, npm will try to use the token instead of OIDC and fail.

3. Verify runners have npm 11.5.1+

   • Why: OIDC trusted publishing requires npm CLI 11.5.1 or later. Node 24 includes npm 11.x so this should be automatic with node-version: current.

• I've read the contributing guidelines
• I've added my name and email to the NOTICE file

[CountBleck]

To implement OIDC, not much change should occur in this repo. I intend to implement this myself.

[BlobMaster41]

To implement OIDC, not much change should occur in this repo. I intend to implement this myself.

Noted. Should I close this PR.?

[HerrCai0907]

Don't do auto format, it make file hard to review

[HerrCai0907]

why we need this file?

[BlobMaster41]

Just for people to see what changed.. The CI in this PR automatically modifies it from the PR merged. Can be removed if not required.

[HerrCai0907]

For my understanding, the file will not be automatically update when PR merged, because there are no git push operation in action. could you explain more about how to automatically modify it

[HerrCai0907]

LGTM

[HerrCai0907]

For my understanding, the file will not be automatically update when PR merged, because there are no git push operation in action. could you explain more about how to automatically modify it

[CountBleck]

I would advise against messing with the npm publishing, because that's mostly aspublish's job. If I'm reading the diff correctly, I see both aspublish and npm publish, which would be incorrect.

Sidenote: if LLMs were used to generate the changes to CI, I would check over it.

[BlobMaster41]

I would advise against messing with the npm publishing, because that's mostly aspublish's job. If I'm reading the diff correctly, I see both aspublish and npm publish, which would be incorrect.

Sidenote: if LLMs were used to generate the changes to CI, I would check over it.

What are you talking about?

aspublish was already in the original workflow, called via npx aspublish, I didn't introduce it. If you look at both the old and new versions, the pattern is the same: npx aspublish handles the main package, and npm publish --access public handles the sub-packages under lib/loader and lib/rtrace. That separation existed before my changes and still exists after them, there is no conflict.

On the token side, npm classic tokens were permanently revoked on December 9, 2025. The old workflow depended on NPM_TOKEN: ${{ secrets.NPM_TOKEN }} which simply does not work anymore. The replacement is OIDC Trusted Publishing, where the CI provider authenticates directly via short-lived tokens instead of stored secrets. That is why the new workflow has id-token: write in the permissions block and no longer references NPM_TOKEN. This is the setup npm officially recommends now and needs to be configured on npmjs.com under the package's Trusted Publisher settings.

The action version bumps (checkout v4 to v6, setup-node v4 to v6) are also just bringing things up to current releases.