[esitarz]

Summary

• Publish ordercloud-javascript-sdk from tag-and-publish.yml with GitHub OIDC instead of NPM_TOKEN. npm write tokens max out at 90 days.
• Request id-token: write and drop NODE_AUTH_TOKEN from the publish step.
• Run CI and publish on Node 24 so the job has npm 11.5.1+, which is what performs the OIDC exchange. Node 22 still ships npm 10.

Before merge

A package maintainer needs to add a trusted publisher on npm for ordercloud-javascript-sdk:

• Organization or user: ordercloud-api
• Repository: ordercloud-javascript-sdk
• Workflow filename: tag-and-publish.yml
• Environment: leave empty
• Allowed actions: npm publish (new publishers default to stage-only, and this workflow runs npm publish)

Leave the NPM_TOKEN secret in place until one publish succeeds, then delete it and revoke the npm token.

Test plan

• Confirm the trusted publisher on npm matches tag-and-publish.yml exactly
• CI build and test pass on Node 24
• After this is on 14.0.0 and that branch merges to master, a version bump publishes without NODE_AUTH_TOKEN
• Delete the NPM_TOKEN GitHub secret and revoke the npm granular token