Conditionally append NPM_TOKEN to .npmrc (#545)

* fix: conditionally append NPM_TOKEN to .npmrc for trusted publishing support

The .npmrc generation now intelligently handles both traditional NPM token
authentication and trusted publishing scenarios:

- Only appends auth token to .npmrc when NPM_TOKEN is defined (not undefined)
- Uses strict comparison (!== undefined) instead of truthy checks
- Provides informative logging when no NPM_TOKEN is present
- Maintains full backward compatibility with existing workflows

This fixes issues with trusted publishing where OIDC tokens from GitHub
Actions are used instead of NPM_TOKEN, preventing 'undefined' from being
written to the registry auth configuration.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Update src/index.ts

Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>

* simplify

* tweak changeset

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>

.changeset/npmrc-trusted-publishing.md

@@ -0,0 +1,5 @@
+---
+"@changesets/action": patch
+---
+
+The `.npmrc` generation now intelligently handles both traditional NPM token authentication and trusted publishing scenarios by only appending the auth token when `NPM_TOKEN` is defined. This prevents 'undefined' from being written to the registry configuration when using OIDC tokens from GitHub Actions trusted publishing.

src/index.ts

@@ -67,7 +67,9 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
         "No changesets found. Attempting to publish any unpublished packages to npm"
       );
 
-      let userNpmrcPath = `${process.env.HOME}/.npmrc`;
+      if (process.env.NPM_TOKEN) {
+        const userNpmrcPath = `${process.env.HOME}/.npmrc`;
+
         if (await fileExists(userNpmrcPath)) {
           core.info("Found existing user .npmrc file");
           const userNpmrcContent = await fs.readFile(userNpmrcPath, "utf8");
@@ -89,12 +91,19 @@ const getOptionalInput = (name: string) => core.getInput(name) || undefined;
             );
           }
         } else {
-        core.info("No user .npmrc file found, creating one");
+          core.info(
+            "No user .npmrc file found, creating one with NPM_TOKEN used as auth token"
+          );
           await fs.writeFile(
             userNpmrcPath,
             `//registry.npmjs.org/:_authToken=${process.env.NPM_TOKEN}\n`
           );
         }
+      } else {
+        core.info(
+          "No NPM_TOKEN found - assuming trusted publishing or npm is already authenticated"
+        );
+      }
 
       const result = await runPublish({
         script: publishScript,