ci(release): switch to npm trusted publishers with OIDC

Author: vmaerten

.github/workflows/release.yml

@@ -4,6 +4,11 @@ on:
   push:
     tags:
       - 'v*'
+      -
+
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
 
 jobs:
   goreleaser:
@@ -19,9 +24,14 @@ jobs:
         with:
           go-version: 1.25.x
 
-      - name: npm-login
-        run: |
-          npm config set '//registry.npmjs.org/:_authToken'=${{ secrets.NPM_TOKEN }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Update npm
+        run: npm install -g npm@latest
+
       - name: Install Task
         uses: go-task/setup-task@v1