ci: modify pre-release to use OIDC

Ticket: DX-2083

Author: Tanjeem Hossain

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
           node-version: ${{ matrix.version }}
           cache: yarn
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --frozen-lockfile
       - name: Lint
         run: yarn lint:check
       - name: Typecheck

.github/workflows/prerelease.yml

@@ -1,4 +1,11 @@
 name: Prerelease
+permissions:
+  # Needed for npm Trusted Publishing
+  id-token: write
+  # Needed for semantic-release
+  contents: write
+  pull-requests: write
+  issues: write
 on:
   push:
     branches:
@@ -7,6 +14,7 @@ jobs:
   release:
     name: Prerelease
     runs-on: ubuntu-latest
+    environment: publish
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -15,14 +23,16 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: 22.x
+      - name: Ensure npm 11.5.1 or later for trusted publishing
+        run: |
+          npm install -g npm@11.5.1
       - name: Install dependencies
         run: yarn
       - name: Build library
         run: yarn build:prod
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
         run: yarn run semantic-release