feat: migrate npm-release.yml to OIDC trusted publishing

Replace static NPM_TOKEN authentication with OIDC token exchange for
npm publishing. OIDC provides short-lived tokens derived from the
GitHub Actions workflow identity, eliminating the risk of long-lived
credential compromise.

Key changes:
- Node version: 18.20 → 24 (bundles npm 11 with native OIDC support)
- Remove NODE_AUTH_TOKEN env var (leaving it undefined triggers OIDC)
- Set NPM_TOKEN to empty string (forces OIDC fallback)
- Fix package.json repository field from SSH shorthand to structured
  HTTPS format (required for OIDC provenance attestation)
- id-token: write permission already present from PR 1

Build gate: verified build + 794 tests pass on Node 24.14.0 (npm 11.9.0)

Snapit OIDC migration deferred — only npm-release.yml is configured as
a Trusted Publisher on npmjs.com. Snapit continues using NPM_TOKEN.

Author: kdaviduik

.github/workflows/npm-release.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: "18.20"
+          node-version: "24"
           cache: 'pnpm'
           registry-url: 'https://registry.npmjs.org'
 
@@ -56,6 +56,8 @@ jobs:
           # scoped to this repo only (contents:write, pull-requests:write),
           # rotated every 2 hours via github-actions-access-provider.
           GITHUB_TOKEN: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
+          # Empty NPM_TOKEN forces npm to fall through to OIDC token exchange.
+          # Do NOT set NODE_AUTH_TOKEN — setup-node's registry-url writes it
+          # into .npmrc; leaving it undefined triggers the OIDC flow.
+          NPM_TOKEN: ''
+          NPM_CONFIG_PROVENANCE: true

package.json

@@ -12,7 +12,10 @@
   ],
   "description": "BuyButton.js allows merchants to build Shopify interfaces into any website",
   "main": "lib/buybutton.umd.js",
-  "repository": "git@github.com:Shopify/buy-button-js.git",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shopify/buy-button-js.git"
+  },
   "publishConfig": {
     "access": "public",
     "@shopify:registry": "https://registry.npmjs.org/",