[STG-1730] ci: fix release workflow for trusted publishing (#167)

* ci: fix release workflow for trusted publishing

- Upgrade setup-node from v4 to v6 for better OIDC support
- Add npm upgrade step for trusted publishing compatibility
- Remove NPM_CONFIG_PROVENANCE env var (not needed with OIDC)

Matches the pattern used in stagehand and openclaw-browserbase repos.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: restore NPM_CONFIG_PROVENANCE for provenance attestation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: upgrade checkout to v6 with full history, keep provenance

- checkout@v4 → v6 with fetch-depth: 0 (changesets needs git history)
- Keep NPM_CONFIG_PROVENANCE=true (only way to pass --provenance through changesets)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: remove NPM_CONFIG_PROVENANCE to match stagehand pattern

Stagehand publishes successfully via changesets + OIDC without this
env var. Removing it to eliminate the one difference between the
two workflows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: shrey150

.github/workflows/release.yml

@@ -18,28 +18,33 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Install pnpm
         uses: pnpm/action-setup@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "22"
           cache: "pnpm"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Update npm for Trusted Publishing
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm build
 
       - name: Create Release Pull Request or Publish to npm
+        id: changesets
         uses: changesets/action@v1
         with:
           publish: pnpm release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true