fix(ci): remove registry-url to fix OIDC trusted publishing (0.16.3)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nolrm

.github/workflows/publish.yml

@@ -24,7 +24,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '22.x'
-          registry-url: 'https://registry.npmjs.org/'
 
       - name: Install dependencies
         run: npm ci
@@ -39,8 +38,6 @@ jobs:
           npm whoami 2>&1 || echo "Not logged in (expected for OIDC)"
 
       - name: Check version and publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           CURRENT_VERSION=$(node -p "require('./package.json').version")
           echo "🔍 Checking version: $CURRENT_VERSION"

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.16.3] - 2026-04-10
+
+### Fixed
+- **CI: remove registry-url from setup-node** — `registry-url` writes an `.npmrc` expecting `NODE_AUTH_TOKEN` which conflicts with OIDC Trusted Publishing; removing it lets `--provenance` handle auth correctly
+
 ## [0.16.2] - 2026-04-10
 
 ### Fixed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nolrm/contextkit",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "ContextKit - Context Engineering for AI Development. Provide rich context to AI through structured MD files with standards, code guides, and documentation. Works with Cursor, Claude, Aider, VS Code Copilot, and more.",
   "main": "lib/index.js",
   "bin": {