From 0b621d0b061c294bd6e94aee9630fecb899e30c7 Mon Sep 17 00:00:00 2001
From: Anton Golub <antongolub@antongolub.com>
Date: Sat, 4 Apr 2026 19:14:50 +0300
Subject: [PATCH 1/3] test: add ts6 to test matrix

---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 41e35febb9..ffb441f528 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -267,7 +267,7 @@ jobs:
     name: smoke-ts${{ matrix.ts }}
     strategy:
       matrix:
-        ts: [4, 5, rc, next]
+        ts: [4, 5, 6, rc, next]
     steps:
       - uses: actions/checkout@v6
         with:

From 85a4d2b1857d406ed9b43d987a4a7afee98e56e9 Mon Sep 17 00:00:00 2001
From: Anton Golub <antongolub@antongolub.com>
Date: Sat, 4 Apr 2026 19:17:23 +0300
Subject: [PATCH 2/3] docs: add npm-oidc-enable example

---
 examples/npm-oidc-enable.mjs | 99 ++++++++++++++++++++++++++++++++++++
 1 file changed, 99 insertions(+)
 create mode 100644 examples/npm-oidc-enable.mjs

diff --git a/examples/npm-oidc-enable.mjs b/examples/npm-oidc-enable.mjs
new file mode 100644
index 0000000000..b3a4f5e3cc
--- /dev/null
+++ b/examples/npm-oidc-enable.mjs
@@ -0,0 +1,99 @@
+#!/usr/bin/env zx
+
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Bulk setup npm OIDC trusted publishing.
+// Requires npm >= 11.5.1.
+
+const config = [
+  {
+    owner: 'semrel-extra',
+    repo: 'zx-semrel',
+    workflow: 'release.yml',
+    packages: ['zx-semrel', '@semrel-extra/zx-semrel'],
+  },
+  // {
+  //   owner: 'semrel-extra',
+  //   repo: 'zx-bulk-release',
+  //   workflow: 'release.yml',
+  //   packages: ['zx-bulk-release', '@semrel-extra/zx-bulk-release'],
+  // },
+]
+
+const dryRun = argv['dry-run']
+const $$ = $({stdio: 'inherit'})
+
+// Check npm version
+const npmVersion = (await $`npm --version`).toString().trim()
+const [major, minor] = npmVersion.split('.').map(Number)
+if (major < 11 || (major === 11 && minor < 10)) {
+  echo`npm >= 11.10.0 required, got ${npmVersion}`
+  process.exit(1)
+}
+
+// Check auth
+try {
+  await $`npm whoami`
+} catch {
+  echo`Not logged in to npm.`
+  await $$`npm login`
+}
+const user = (await $`npm whoami`).toString().trim()
+echo`Logged in as: ${user}\n`
+
+// Summary
+const total = config.reduce((n, e) => n + e.packages.length, 0)
+echo`${total} package(s) across ${config.length} repo(s)${dryRun ? ' (dry run)' : ''}:\n`
+for (const {owner, repo, workflow, packages} of config) {
+  echo`  ${owner}/${repo} (${workflow}): ${packages.join(', ')}`
+}
+
+if (!dryRun) {
+  echo``
+  echo`First package will prompt for TOTP.`
+  echo`Enable 5-min skip window to avoid re-entering for the rest.`
+  const ok = await question('\nProceed? [y/N] ')
+  if (ok.toLowerCase() !== 'y') process.exit(0)
+}
+echo``
+
+// Apply
+let passed = 0, failed = 0
+
+for (const {owner, repo, workflow, packages} of config) {
+  const slug = `${owner}/${repo}`
+  echo`${slug} (${workflow})`
+
+  for (const pkg of packages) {
+    const flags = ['--yes', `--file=${workflow}`, `--repo=${slug}`]
+    try {
+      if (dryRun) {
+        echo`  [skip] npm trust github ${pkg} ${flags.join(' ')}`
+      } else {
+        await $$`npm trust github ${pkg} ${flags}`
+        echo`  ✓ ${pkg}`
+      }
+      passed++
+    } catch (e) {
+      echo`  ✗ ${pkg}: ${e.stderr?.trim() || e.message}`
+      failed++
+    }
+    if (!dryRun) await sleep(2000)
+  }
+  echo``
+}
+
+echo`Done: ${passed} ok, ${failed} failed`
+if (failed) process.exit(1)

From 89fe4fc711333fab256f5aa2dd6d5b4ad36b6f02 Mon Sep 17 00:00:00 2001
From: Anton Golub <antongolub@antongolub.com>
Date: Sun, 5 Apr 2026 20:36:07 +0300
Subject: [PATCH 3/3] chore: linting

---
 examples/npm-oidc-enable.mjs | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/examples/npm-oidc-enable.mjs b/examples/npm-oidc-enable.mjs
index b3a4f5e3cc..75a458e4c2 100644
--- a/examples/npm-oidc-enable.mjs
+++ b/examples/npm-oidc-enable.mjs
@@ -33,7 +33,7 @@ const config = [
 ]
 
 const dryRun = argv['dry-run']
-const $$ = $({stdio: 'inherit'})
+const $$ = $({ stdio: 'inherit' })
 
 // Check npm version
 const npmVersion = (await $`npm --version`).toString().trim()
@@ -56,7 +56,7 @@ echo`Logged in as: ${user}\n`
 // Summary
 const total = config.reduce((n, e) => n + e.packages.length, 0)
 echo`${total} package(s) across ${config.length} repo(s)${dryRun ? ' (dry run)' : ''}:\n`
-for (const {owner, repo, workflow, packages} of config) {
+for (const { owner, repo, workflow, packages } of config) {
   echo`  ${owner}/${repo} (${workflow}): ${packages.join(', ')}`
 }
 
@@ -70,9 +70,10 @@ if (!dryRun) {
 echo``
 
 // Apply
-let passed = 0, failed = 0
+let passed = 0,
+  failed = 0
 
-for (const {owner, repo, workflow, packages} of config) {
+for (const { owner, repo, workflow, packages } of config) {
   const slug = `${owner}/${repo}`
   echo`${slug} (${workflow})`