ci: Add support for trusted publisher workflow

Author: nca-work

.github/workflows/publish.yml

@@ -6,6 +6,12 @@ on:
         description: "ORR id for the change/release"
         required: true
         type: string
+        default: ORR-8317
+      dry_run:
+        description: "Run the publish step in dry-run"
+        required: true
+        type: boolean
+        default: false
 
 jobs:
   publish:
@@ -14,6 +20,7 @@ jobs:
     outputs:
       release_number: ${{steps.get_latest_release_number.outputs.release_tag}}
     permissions:
+      id-token: write
       contents: write
       pull-requests: write
     steps:
@@ -24,7 +31,7 @@ jobs:
           path: xero-node
 
       - name: Set up Node environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: 'npm'
@@ -52,7 +59,7 @@ jobs:
       - name: Publish to npm
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm publish
+        run: npm publish ${{ inputs.dry_run && '--dry-run' || '' }}
         working-directory: xero-node
 
   notify-codegen-repo: