fix: restore setup-node registry-url but remove .npmrc to support OIDC

Author: orange-guo

.github/workflows/release.yml

@@ -19,6 +19,7 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
         run: yarn install
@@ -30,11 +31,15 @@ jobs:
         # It will only publish if the version in package.json is new
         # Note: Trusted Publishing requires permissions: id-token: write
         run: |
-          echo "registry=https://registry.npmjs.org/" > .npmrc
+          # setup-node creates an .npmrc with an empty token which breaks Trusted Publishing
+          # We need to remove it but keep the registry configuration
+          rm -f .npmrc
+          npm config set registry https://registry.npmjs.org/
+
           PACKAGE_NAME=$(node -p "require('./package.json').name")
           PACKAGE_VERSION=$(node -p "require('./package.json').version")
           if npm view "$PACKAGE_NAME" version | grep -q "$PACKAGE_VERSION"; then
             echo "Version $PACKAGE_VERSION already exists on NPM. Skipping publish."
           else
-            npm publish --provenance --access public --verbose --registry https://registry.npmjs.org/
+            npm publish --provenance --access public --verbose
           fi