Improve release flow with draft releases and OIDC npm publishing (#272)

* Improve release flow by using draft releases in tagpr

- Change tagpr configuration from `release = true` to `release = draft`
- This creates draft releases instead of immediately published ones
- The release.yml workflow will then publish the release with artifacts
- Provides better separation of concerns and safer release process

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* Migrate npm publishing to OIDC Trusted Publishers

- Add id-token: write and contents: read permissions to npm-publish job
- Remove NODE_AUTH_TOKEN from both dry-run and publish steps
- npm CLI will automatically detect OIDC environment for authentication
- Enables automatic provenance attestations for enhanced security
- Eliminates need for long-lived NPM_TOKEN secret management

Requires manual configuration of Trusted Publisher on npmjs.com:
- Organization: sugyan
- Repository: claude-code-webui
- Workflow: release.yml

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

---------

Co-authored-by: Claude <[email protected]>

Author: sugyan

.github/workflows/release.yml

@@ -135,6 +135,9 @@ jobs:
   npm-publish:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # Required for OIDC authentication
+      contents: read # Required for repository access
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -177,11 +180,7 @@ jobs:
       - name: Publish to npm (dry-run)
         run: npm publish --dry-run
         working-directory: backend
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish to npm
         run: npm publish
         working-directory: backend
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.tagpr

@@ -10,8 +10,8 @@
 	# Use "v" prefix for tags (v1.0.0, v1.0.1, etc.)
 	vPrefix = false
 
-	# Create GitHub Releases automatically
-	release = true
+	# Create GitHub Releases automatically as draft
+	release = draft
 
 	# Version file location - now using package.json
 	versionFile = backend/package.json