fix: update npm to latest for OIDC trusted publishing

Author: jaykaycodes

.claude-plugin/marketplace.json

@@ -6,13 +6,13 @@
   },
   "metadata": {
     "description": "Multi-layer codebase analysis tools",
-    "version": "1.0.7"
+    "version": "1.0.8"
   },
   "plugins": [
     {
       "name": "codebase-analyzer",
       "description": "Multi-layer codebase analysis with Gemini AI. 4 agents, 5 commands, 3 skills for architecture analysis, pattern detection, and dataflow tracing.",
-      "version": "1.0.7",
+      "version": "1.0.8",
       "author": {
         "name": "Jake Correa",
         "url": "https://github.com/jaykaycodes"

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-analyzer",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Multi-layer codebase analysis with Gemini AI. 4 agents, 5 commands, 3 skills for architecture analysis, pattern detection, and dataflow tracing.",
   "author": {
     "name": "Jake Correa",

.github/workflows/ci.yml

@@ -56,7 +56,10 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-          # Note: Don't use registry-url here - it creates an .npmrc that interferes with OIDC trusted publishing
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Update npm for trusted publishing
+        run: npm install -g npm@latest
 
       - name: Install dependencies
         run: bun install
@@ -83,13 +86,10 @@ jobs:
       - name: Debug npm config
         if: steps.version.outputs.changed == 'true'
         run: |
+          echo "=== npm version (must be >= 11.5.1 for trusted publishing) ==="
+          npm --version
           echo "=== npm config ==="
           npm config list
-          echo "=== .npmrc files ==="
-          cat ~/.npmrc 2>/dev/null || echo "No ~/.npmrc"
-          cat .npmrc 2>/dev/null || echo "No ./.npmrc"
-          echo "=== npm whoami ==="
-          npm whoami 2>&1 || echo "Not logged in (expected for OIDC)"
 
       - name: Publish to npm (trusted publisher)
         if: steps.version.outputs.changed == 'true'

CLAUDE.md

@@ -139,6 +139,8 @@ CI automatically publishes to npm when version changes on main.
 
 **Trusted publisher config:** npm package must be linked to `jaykaycodes/codebase-analyzer-mcp` in npm settings (Settings → Publishing access → Add GitHub Actions as publisher).
 
+**Requirements:** npm >= 11.5.1 (CI updates npm automatically). See [npm trusted publishing docs](https://docs.npmjs.com/trusted-publishers/).
+
 ## Key Learnings
 
 _This section captures learnings as we work on this repository._

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebase-analyzer-mcp",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Multi-layer codebase analysis with Gemini AI. MCP server + Claude plugin with progressive disclosure.",
   "type": "module",
   "main": "dist/mcp/server.js",