ci: update workflow for trusted publishing

Author: damienbutt

.github/workflows/ci.yml

@@ -13,6 +13,9 @@ jobs:
   build:
     name: Build, lint, and test on Node ${{ matrix.node }} and ${{ matrix.os }}
 
+    permissions:
+      contents: read
+
     runs-on: ${{ matrix.os }}
 
     strategy:
@@ -67,6 +70,12 @@ jobs:
   release:
     name: Release
 
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
+
     if: ${{ github.ref == 'refs/heads/master' }}
 
     needs: [build]
@@ -90,19 +99,15 @@ jobs:
         with:
           node-version-file: .nvmrc
           cache: "pnpm"
+          registry-url: https://registry.npmjs.org/
 
       - name: Install
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm build
 
       - name: Release
         run: pnpm semantic-release
         env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GIT_AUTHOR_NAME: ${{ secrets.SEMANTIC_RELEASE_GIT_NAME }}
-          GIT_AUTHOR_EMAIL: ${{ secrets.SEMANTIC_RELEASE_GIT_EMAIL }}
-          GIT_COMMITTER_NAME: ${{ secrets.SEMANTIC_RELEASE_GIT_NAME }}
-          GIT_COMMITTER_EMAIL: ${{ secrets.SEMANTIC_RELEASE_GIT_EMAIL }}

.releaserc.json

@@ -88,7 +88,13 @@
                 "changelogTitle": "# Changelog"
             }
         ],
-        "@semantic-release/npm",
+        [
+            "@semantic-release/npm",
+            {
+                "npmPublish": true,
+                "provenance": true
+            }
+        ],
         [
             "@semantic-release/git",
             {