support new npm publishing

Author: dobrac

.github/workflows/release_candidates.yml

@@ -41,6 +41,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   release:
@@ -86,7 +87,7 @@ jobs:
           version: '${{ env.TOOL_VERSION_PNPM }}'
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         if: ${{ env.IS_JS == 'true' || env.IS_CLI == 'true' || env.IS_PYTHON == 'true' }}
         with:
           node-version: '${{ env.TOOL_VERSION_NODEJS }}'
@@ -99,6 +100,12 @@ jobs:
           pnpm config set auto-install-peers true
           pnpm config set exclude-links-from-lockfile true
 
+      - name: Update npm
+        if: ${{ env.IS_JS == 'true' || env.IS_CLI == 'true' }}
+        run: |
+          npm install -g npm@^11.6
+          npm --version
+
       - name: Set up Python
         uses: actions/setup-python@v4
         if: ${{ env.IS_PYTHON == 'true' }}
@@ -151,9 +158,7 @@ jobs:
         if: ${{ env.IS_JS == 'true' }}
         run: |
           npm version prerelease --preid=${{ env.PREID }}
-          npm publish --tag ${{ env.PUBLISH_TAG }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm publish --tag ${{ env.PUBLISH_TAG }} --provenance
 
       - name: Install dependencies
         if: ${{ env.IS_JS == 'true' || env.IS_CLI == 'true' }}
@@ -165,9 +170,7 @@ jobs:
         if: ${{ env.IS_CLI == 'true' }}
         run: |
           npm version prerelease --preid=${{ env.PREID }}
-          npm publish --tag ${{ env.PUBLISH_TAG }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          npm publish --tag ${{ env.PUBLISH_TAG }} --provenance
 
       - name: Commit new versions
         if: ${{ env.IS_JS == 'true' || env.IS_CLI == 'true' || env.IS_PYTHON == 'true' }}