refactor: use npm provenance (OIDC) for tokenless publishing

No OTP or npm automation token needed. GitHub Actions OIDC
identity authenticates directly with npm registry.

Author: BartWaardenburg

.github/workflows/release.yml

@@ -10,8 +10,45 @@ env:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
+  publish-crates:
+    name: Publish Rust crates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Publish srcmap-codec
+        run: cargo publish -p srcmap-codec || echo "Already published, skipping"
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
+      - name: Publish srcmap-sourcemap
+        run: cargo publish -p srcmap-sourcemap || echo "Already published, skipping"
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+      - name: Publish srcmap-generator
+        run: cargo publish -p srcmap-generator || echo "Already published, skipping"
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+      - name: Wait for crates.io index
+        run: sleep 30
+
+      - name: Publish srcmap-remapping
+        run: cargo publish -p srcmap-remapping || echo "Already published, skipping"
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
   build-napi:
     name: Build NAPI - ${{ matrix.settings.target }}
     runs-on: ${{ matrix.settings.host }}
@@ -128,10 +165,89 @@ jobs:
           path: packages/sourcemap-wasm/pkg/
           if-no-files-found: error
 
+  publish-npm:
+    name: Publish npm packages
+    runs-on: ubuntu-latest
+    needs: [build-napi, build-wasm]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+
+      - name: Install @napi-rs/cli
+        run: npm install -g @napi-rs/cli
+
+      - name: Download all codec NAPI artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: packages/codec/artifacts
+          pattern: codec-bindings-*
+          merge-multiple: false
+
+      - name: Download all sourcemap NAPI artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: packages/sourcemap/artifacts
+          pattern: sourcemap-bindings-*
+          merge-multiple: false
+
+      - name: Download WASM artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: wasm-package
+          path: packages/sourcemap-wasm/pkg
+
+      - name: Move codec artifacts
+        run: napi artifacts -d artifacts
+        working-directory: packages/codec
+
+      - name: Move sourcemap artifacts
+        run: napi artifacts -d artifacts
+        working-directory: packages/sourcemap
+
+      - name: Publish @srcmap/codec platform packages
+        run: |
+          for dir in npm/*/; do
+            npm publish "$dir" --access public --provenance || echo "Skipping $(basename "$dir")"
+          done
+        working-directory: packages/codec
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish @srcmap/codec
+        run: npm publish --access public --provenance --ignore-scripts
+        working-directory: packages/codec
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish @srcmap/sourcemap platform packages
+        run: |
+          for dir in npm/*/; do
+            npm publish "$dir" --access public --provenance || echo "Skipping $(basename "$dir")"
+          done
+        working-directory: packages/sourcemap
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish @srcmap/sourcemap
+        run: npm publish --access public --provenance --ignore-scripts
+        working-directory: packages/sourcemap
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish @srcmap/sourcemap-wasm
+        run: npm publish --access public --provenance --ignore-scripts
+        working-directory: packages/sourcemap-wasm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
   create-release:
     name: Create GitHub Release
     runs-on: ubuntu-latest
-    needs: [build-napi, build-wasm]
+    needs: [publish-crates, publish-npm]
     steps:
       - uses: actions/checkout@v4