No npm token: the workflow's OIDC identity is the npm trusted publisher, and npm records provenance for the tag's commit.
marc