fix: use npx npm@latest for OIDC trusted publishing (#4724)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/cli-node-cd.yml

@@ -30,9 +30,6 @@ jobs:
           cache: 'pnpm'
           cache-dependency-path: cli/node/pnpm-lock.yaml
 
-      - name: Upgrade npm for OIDC trusted publishing
-        run: npm install -g npm@latest
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -43,7 +40,7 @@ jobs:
         run: |
           if [ "${{ github.event.release.prerelease }}" = "true" ]; then
             PREID=$(node -p "require('./package.json').version.split('-')[1].split('.')[0]")
-            npm publish --provenance --access public --tag "$PREID"
+            npx npm@latest publish --provenance --access public --tag "$PREID"
           else
-            npm publish --provenance --access public
+            npx npm@latest publish --provenance --access public
           fi

.github/workflows/openclaw-cd.yml

@@ -30,9 +30,6 @@ jobs:
           cache: 'pnpm'
           cache-dependency-path: openclaw/pnpm-lock.yaml
 
-      - name: Upgrade npm for OIDC trusted publishing
-        run: npm install -g npm@latest
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -43,7 +40,7 @@ jobs:
         run: |
           if [ "${{ github.event.release.prerelease }}" = "true" ]; then
             PREID=$(node -p "require('./package.json').version.split('-')[1].split('.')[0]")
-            npm publish --provenance --access public --tag "$PREID"
+            npx npm@latest publish --provenance --access public --tag "$PREID"
           else
-            npm publish --provenance --access public
+            npx npm@latest publish --provenance --access public
           fi

.github/workflows/ts-sdk-cd.yml

@@ -30,9 +30,6 @@ jobs:
           cache: 'pnpm'
           cache-dependency-path: mem0-ts/pnpm-lock.yaml
 
-      - name: Upgrade npm for OIDC trusted publishing
-        run: npm install -g npm@latest
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -43,7 +40,7 @@ jobs:
         run: |
           if [ "${{ github.event.release.prerelease }}" = "true" ]; then
             PREID=$(node -p "require('./package.json').version.split('-')[1].split('.')[0]")
-            npm publish --provenance --access public --tag "$PREID"
+            npx npm@latest publish --provenance --access public --tag "$PREID"
           else
-            npm publish --provenance --access public
+            npx npm@latest publish --provenance --access public
           fi

.github/workflows/vercel-ai-cd.yml

@@ -30,9 +30,6 @@ jobs:
           cache: 'pnpm'
           cache-dependency-path: vercel-ai-sdk/pnpm-lock.yaml
 
-      - name: Upgrade npm for OIDC trusted publishing
-        run: npm install -g npm@latest
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -43,7 +40,7 @@ jobs:
         run: |
           if [ "${{ github.event.release.prerelease }}" = "true" ]; then
             PREID=$(node -p "require('./package.json').version.split('-')[1].split('.')[0]")
-            npm publish --provenance --access public --tag "$PREID"
+            npx npm@latest publish --provenance --access public --tag "$PREID"
           else
-            npm publish --provenance --access public
+            npx npm@latest publish --provenance --access public
           fi