[ivankristianto]

Summary

Release 0.8.0 with the dependency update from #31, and switch npm publishing from the 2020 NPM_TOKEN to trusted publishing (OIDC). npm still serves 0.7.0 from 2022; the 0.7.1 release never reached npm because its tag kept "version": "0.7.0".

Closes: no linked issue.

Type of change

• Feature
• Bug fix
• Refactor (no behavior change)
• Dependency or infrastructure update
• Docs

Changes

• ci: publish to npm with trusted publishing
  • npm-publish.yml: the publish job gets id-token: write, drops NODE_AUTH_TOKEN, and disables the package-manager cache, following npm's trusted publishing docs (https://docs.npmjs.com/trusted-publishers). Lint now runs only in the build job it already ran in.
  • package.json repository.url moves from git@github.com:… to git+https://github.com/ivankristianto/cloudflare-cli-node.git. Trusted publishing checks it against the repo.
  • CLAUDE.md gets a Releasing section. npm version runs postversion: git push, which the main ruleset now rejects, so the version bump goes through a PR.
• chore(release): 0.8.0: version and lockfile, and CHANGELOG [next] becomes [0.8.0] - 2026-11-04 with a Security entry.

Why the token has to go: it was created 2020-06-15 and never updated, so it's a classic token. npm announced the revocation of all classic tokens in late 2025 (https://github.blog/changelog/2025-10-10-strengthening-npm-security-important-changes-to-authentication-and-token-management).

How to test

1. npm ci && npm test && npm run lint on Node 22.18.0 and 26. Done locally: 16 tests, lint 0 errors.
2. npm pack --dry-run shows cloudflare-cli-node@0.8.0 with lib/, bin/cf, README, LICENSE, CHANGELOG, HOWTO.
3. The publish path can only be tested by a real release. Before creating it, add the trusted publisher on npmjs.com (below).

Risk and rollback

• Manual step on npmjs.com, before the release. Under package cloudflare-cli-node, Settings, Trusted Publisher, GitHub Actions, enter user ivankristianto, repository cloudflare-cli-node, workflow npm-publish.yml, and no environment. npm doesn't validate this when saved. A typo shows up as a failed publish.
• If the publish job fails, nothing is published. Fix the npmjs.com settings and re-run the job from the Actions tab.
• After a successful publish, delete the NPM_TOKEN repo secret and consider "disallow tokens" on the package.
• Known issue to mention in the release notes: cf firewall and cf filters fail with *.api.deprecated because Cloudflare retired those APIs in favour of Rulesets. This is not a regression.
• Rollback: revert the merge. If 0.8.0 is already published, use npm deprecate cloudflare-cli-node@0.8.0 "<reason>". npm doesn't allow re-publishing the same version.

Checklist

• npm test passes
• npm run lint passes
• node bin/cf <command> --help loads for every command touched
• CHANGELOG.md updated under ## [next] for user-facing changes