chore(ci): Drop NPM_TOKEN in favor of npm Trusted Publishing

.github/workflows/cd-mobile-mcp.yml

@@ -34,6 +34,9 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           scope: '@qwen-code'
 
+      - name: 'Install npm 11'
+        run: 'npm install --global npm@11.19.0'
+
       - name: 'Determine version'
         id: 'version'
         run: |
@@ -69,5 +72,3 @@ jobs:
         if: '${{ !inputs.dry_run }}'
         working-directory: 'packages/mobile-mcp'
         run: 'npm publish --provenance --access public'
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'

.github/workflows/release-sdk.yml

@@ -102,6 +102,9 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           scope: '@qwen-code'
 
+      - name: 'Install npm 11'
+        run: 'npm install --global npm@11.19.0'
+
       - name: 'Install Dependencies'
         run: |-
           npm ci
@@ -295,8 +298,6 @@ jobs:
         working-directory: 'packages/sdk-typescript'
         run: |-
           npm publish --provenance --access public --tag=${{ steps.version.outputs.NPM_TAG }} ${{ steps.vars.outputs.is_dry_run == 'true' && '--dry-run' || '' }}
-        env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
 
       - name: 'Create and switch to a release branch'
         if: |-

.github/workflows/release.yml

@@ -386,6 +386,9 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           scope: '@qwen-code'
 
+      - name: 'Install npm 11'
+        run: 'npm install --global npm@11.19.0'
+
       - name: 'Install Dependencies'
         env:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
@@ -531,7 +534,6 @@ jobs:
           fi
           npm publish --provenance "${PUBLISH_ARGS[@]}"
         env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
           RELEASE_VERSION: '${{ needs.prepare.outputs.release_version }}'
           NPM_TAG: '${{ needs.prepare.outputs.npm_tag }}'
           IS_DRY_RUN: '${{ needs.prepare.outputs.is_dry_run }}'
@@ -549,7 +551,6 @@ jobs:
           fi
           npm publish --provenance "${PUBLISH_ARGS[@]}"
         env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
           RELEASE_VERSION: '${{ needs.prepare.outputs.release_version }}'
           NPM_TAG: '${{ needs.prepare.outputs.npm_tag }}'
           IS_DRY_RUN: '${{ needs.prepare.outputs.is_dry_run }}'
@@ -567,7 +568,6 @@ jobs:
           fi
           npm publish --provenance "${PUBLISH_ARGS[@]}"
         env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
           RELEASE_VERSION: '${{ needs.prepare.outputs.release_version }}'
           NPM_TAG: '${{ needs.prepare.outputs.npm_tag }}'
           IS_DRY_RUN: '${{ needs.prepare.outputs.is_dry_run }}'
@@ -598,7 +598,6 @@ jobs:
             echo "::warning::Every channel package was already published; nothing shipped"
           fi
         env:
-          NODE_AUTH_TOKEN: '${{ secrets.NPM_TOKEN }}'
           RELEASE_VERSION: '${{ needs.prepare.outputs.release_version }}'
           NPM_TAG: '${{ needs.prepare.outputs.npm_tag }}'
           IS_DRY_RUN: '${{ needs.prepare.outputs.is_dry_run }}'

packages/audio-capture/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/audio-capture",
   "version": "0.21.11",
   "description": "Native microphone capture backend for Qwen Code voice input",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/audio-capture"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/channels/base/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/channel-base",
   "version": "0.21.11",
   "description": "Base channel infrastructure for Qwen Code",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/channels/base"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/channels/dingtalk/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/channel-dingtalk",
   "version": "0.21.11",
   "description": "DingTalk channel adapter for Qwen Code",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/channels/dingtalk"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/channels/feishu/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/channel-feishu",
   "version": "0.21.11",
   "description": "Feishu (Lark) channel adapter for Qwen Code",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/channels/feishu"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/channels/github/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/channel-github",
   "version": "0.21.11",
   "description": "GitHub polling channel adapter for Qwen Code",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/channels/github"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/channels/qqbot/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/channel-qqbot",
   "version": "0.21.11",
   "description": "QQ Bot (QQ机器人) channel adapter for Qwen Code",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/channels/qqbot"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/channels/telegram/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/channel-telegram",
   "version": "0.21.11",
   "description": "Telegram channel adapter for Qwen Code",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/channels/telegram"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/channels/wecom/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/channel-wecom",
   "version": "0.21.11",
   "description": "WeCom channel adapter for Qwen Code",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/channels/wecom"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/channels/weixin/package.json

@@ -2,6 +2,11 @@
   "name": "@qwen-code/channel-weixin",
   "version": "0.21.11",
   "description": "WeChat (Weixin) channel adapter for Qwen Code",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QwenLM/qwen-code.git",
+    "directory": "packages/channels/weixin"
+  },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

scripts/tests/package-scripts.test.js

@@ -478,6 +478,51 @@ describe('package scripts', () => {
     );
   });
 
+  it('meets npm trusted publishing requirements', () => {
+    for (const [workflowPath, jobName, publishStepName] of [
+      [
+        '.github/workflows/release.yml',
+        'publish',
+        'Publish @qwen-code/audio-capture',
+      ],
+      [
+        '.github/workflows/release-sdk.yml',
+        'release-sdk',
+        'Publish @qwen-code/sdk',
+      ],
+      ['.github/workflows/cd-mobile-mcp.yml', 'build-and-publish', 'Publish'],
+    ]) {
+      const publishJob = getWorkflowJob(readWorkflow(workflowPath), jobName);
+      const installStep = getWorkflowStep(publishJob, 'Install npm 11');
+      expect(installStep).toContain('npm install --global npm@11.19.0');
+      expect(publishJob.indexOf(installStep)).toBeLessThan(
+        publishJob.indexOf(getWorkflowStep(publishJob, publishStepName)),
+      );
+    }
+
+    for (const packageDirectory of [
+      'packages/audio-capture',
+      'packages/cli',
+      'packages/channels/base',
+      'packages/channels/dingtalk',
+      'packages/channels/feishu',
+      'packages/channels/github',
+      'packages/channels/qqbot',
+      'packages/channels/telegram',
+      'packages/channels/wecom',
+      'packages/channels/weixin',
+      'packages/mobile-mcp',
+      'packages/sdk-typescript',
+    ]) {
+      const packageJson = JSON.parse(
+        readFileSync(path.join(root, packageDirectory, 'package.json'), 'utf8'),
+      );
+      expect(packageJson.repository?.url?.replace(/^git\+/, '')).toBe(
+        'https://github.com/QwenLM/qwen-code.git',
+      );
+    }
+  });
+
   it('fast-tracks trusted autofix issue triggers before LLM assessment', () => {
     const workflow = readWorkflow('.github/workflows/qwen-autofix.yml');
     const issueJob = getWorkflowJob(workflow, 'issue-autofix');