feat(ci): add npm-publish environment for trusted publisher

[karelhala]

Description

• Adds environment: npm-publish to the release job so GitHub mints OIDC tokens scoped to the environment registered in npm's trusted publisher settings
• Removes workflow_dispatch trigger that was blocked by the if condition (dead code)
• Removes the if guard since the only remaining trigger is push to master

No downstream repos are affected — this changes how packages are authenticated with npm, not what gets published.

---

Blast radius

• Affects the CI release pipeline for @redhat-cloud-services/hcc-pf-mcp, hcc-feo-mcp, and hcc-kessel-mcp
• No consumer-facing changes — published packages remain identical
• Requires the npm-publish environment to be configured on the GitHub repo and trusted publishers to be registered on npmjs.com for all three packages

---

Rollback plan

• git revert is sufficient — releases will fall back to token-based authentication if an NPM_TOKEN secret is still configured
• If trusted publishers are already the sole auth method, re-register the packages without an environment name on npmjs.com

---

Checklist

• Tested against at least one consuming repo/service
• No breaking changes to existing consumers (or migration path documented)
• No hardcoded secrets, tokens, or passwords
• Container images pinned to specific tags, not latest

AI disclosure

Assisted by: Claude Code (Claude Opus 4.6)

[coderabbitai]

Summary by CodeRabbit

• Chores
  • Updated release workflow configuration to enhance deployment stability and control.

---

Note: This release contains infrastructure updates with no user-facing changes.

Walkthrough

The Release workflow configuration is updated to remove manual trigger capability and to associate the release job with a GitHub Environment for controlled deployments. The workflow now runs only on pushes to the master branch and executes within the npm-publish environment context.

Changes

Release Workflow Configuration

Layer / File(s)	Summary
Release workflow trigger and environment setup .github/workflows/release.yml	The workflow_dispatch trigger is removed, restricting execution to automatic pushes to master. The release job is assigned to the npm-publish environment for permission and secret management.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding npm-publish environment for trusted publisher authentication in the CI workflow.
Description check	✅ Passed	The pull request description is comprehensive and covers all required template sections including description, blast radius, rollback plan, and checklist with detailed explanations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/release.yml (1)

36-36: ⚠️ Potential issue | 🟠 Major

Update pinned npm version in release workflow (.github/workflows/release.yml)

• The workflow installs npm@11.6.2 globally, but the latest stable npm is 11.16.0 (released May 27, 2026).
• npm@11.6.2 is flagged by security scanners due to vulnerable bundled dependencies (e.g., tar/glob; e.g., GHSA-29xp-372q-xqph).

Update the pin to npm@11.16.0 (or newer) to reduce security risk.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 36, The workflow step currently
installs a pinned vulnerable npm version in the line "run: npm install -g
npm@11.6.2"; update that command to install a current stable npm (e.g., change
to "npm@11.16.0" or newer) so the release job uses the updated npm release and
avoids the flagged bundled dependency vulnerabilities.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Line 16: Remove the redundant job-level condition "if: github.event_name ==
'push' && github.ref == 'refs/heads/master'" from the release workflow (it
duplicates the top-level trigger); open .github/workflows/release.yml, locate
the job that contains the if: line and delete that entire conditional so the job
relies solely on the workflow's push-to-master trigger.

---

Outside diff comments:
In @.github/workflows/release.yml:
- Line 36: The workflow step currently installs a pinned vulnerable npm version
in the line "run: npm install -g npm@11.6.2"; update that command to install a
current stable npm (e.g., change to "npm@11.16.0" or newer) so the release job
uses the updated npm release and avoids the flagged bundled dependency
vulnerabilities.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 8c1f6602-706d-4198-bb5c-82733e63f92c

📥 Commits

Reviewing files that changed from the base of the PR and between 2baba51 and f632e25.

📒 Files selected for processing (1)

• .github/workflows/release.yml

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Redundant if condition contradicts PR description.

The PR description states "Removes the if guard since the only remaining trigger is push to master", but the if condition is still present on line 16. Since the workflow now only triggers on push to master (lines 4-6), this condition always evaluates to true when the job runs and should be removed.

♻️ Proposed fix

     name: Release Packages
-    # Only run on push to master branch (never on workflow_dispatch, etc.)
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     environment: npm-publish

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 16, Remove the redundant job-level
condition "if: github.event_name == 'push' && github.ref == 'refs/heads/master'"
from the release workflow (it duplicates the top-level trigger); open
.github/workflows/release.yml, locate the job that contains the if: line and
delete that entire conditional so the job relies solely on the workflow's
push-to-master trigger.

[justinorringer]

This is redundant code. If Karel doesn't remove it by next week, there shouldnt be a problem with merging the other changes.

[coderabbitai]

@justinorringer Thanks for the note! Would you like me to open a follow-up issue to track the removal of that redundant if condition, so it doesn't get lost?