[dhruva-vapi]

Summary

Move the React SDK's release workflow to npm trusted publishing, following the Web SDK migration in VapiAI/client-sdk-web#165.

The v0.1.2 publish failed with E404. The workflow still uses Node 18/npm 10 and NPM_TOKEN; the error alone does not establish whether that token expired or lacks access.

• Use Node 24 for an OIDC-capable npm CLI.
• Grant the publish job contents: read and id-token: write.
• Remove the publish step's NODE_AUTH_TOKEN reference.
• Disable dependency caching in the release job, consistent with npm's trusted-publishing guidance.
• Preserve the release trigger, version check, lint/type/format checks, both builds, and publish command.

Before release

Configure an npm trusted publisher for @vapi-ai/client-sdk-react:

• Provider: GitHub Actions
• Organization: VapiAI
• Repository: client-sdk-react
• Workflow filename: publish.yml
• Environment: leave blank
• Allow direct npm publish for the existing publish command.

npm settings have not been verified or changed. No secrets are removed by this PR. Coordinate trust setup with release readiness: npm requires the first successful publish within two days of creating a new trust configuration.

Rerunning the failed v0.1.2 job retains its original ref/SHA and will not pick up this workflow change. Select a separate recovery/release path after review; this PR does not retag or publish a release.

Validation

• YAML parsing and targeted workflow invariants passed.
• Patch application check passed against current main.
• No local build, actionlint, live OIDC authentication, or npm publication performed. Existing PR CI runs on Node 18 and does not prove Node 24 publishing works.

References: npm trusted publishing, GitHub rerun behavior.