chore: use npm trusted publishers (OIDC) instead of NPM_TOKEN

Author: benjamine

.github/workflows/release-mcp.yml

@@ -8,17 +8,18 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 'lts/*'
           cache: 'npm'
           registry-url: 'https://registry.npmjs.org'
       - run: npm ci
       - run: npm run build
         working-directory: ./packages/jsondiffpatch
-      - run: npm publish
+      - run: npm publish --provenance --access public
         working-directory: ./packages/diff-mcp
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release.yml

@@ -8,15 +8,16 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 'lts/*'
           cache: 'npm'
           registry-url: 'https://registry.npmjs.org'
       - run: npm ci
-      - run: npm publish
+      - run: npm publish --provenance --access public
         working-directory: ./packages/jsondiffpatch
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}