Npm trusted publish

.github/actions/setup/action.yml

@@ -21,7 +21,7 @@ runs:
         cache: 'pnpm'
     - name: Set up pnpm via Corepack
       shell: bash
-      run: corepack prepare pnpm@10.17.0 --activate
+      run: corepack prepare pnpm@10.28.0 --activate
     - name: Install dependencies
       shell: bash
       run: pnpm install --frozen-lockfile

.github/workflows/publish.yml

@@ -8,29 +8,55 @@ on:
         required: true
         type: choice
         options:
+          - address-book
           - contracts
+          - interfaces
           - sdk
+          - toolshed
       tag:
         description: 'Tag to publish'
         required: true
         type: string
         default: latest
+      dry_run:
+        description: 'Dry-run (validate only, no publish or git tag)'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   publish:
     name: Publish package
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           submodules: recursive
       - name: Set up environment
         uses: ./.github/actions/setup
-      - name: Set npm token for publishing
-        run: pnpm config set //registry.npmjs.org/:_authToken ${{ secrets.GRAPHPROTOCOL_NPM_TOKEN }}
+      - name: Upgrade npm for OIDC trusted publishing
+        # pnpm publish delegates registry auth to the underlying npm CLI.
+        # OIDC trusted publishing requires npm >= 11.5.1; pinned to a known-good
+        # version for reproducibility — safe to bump as long as it stays >= 11.5.1.
+        run: npm install -g npm@11.13.0
+      - name: Read package info
+        id: pkg
+        shell: bash
+        run: |
+          PKG_NAME=$(node -p "require('./packages/${{ inputs.package }}/package.json').name")
+          PKG_VERSION=$(node -p "require('./packages/${{ inputs.package }}/package.json').version")
+          echo "tag=${PKG_NAME}@${PKG_VERSION}" >> $GITHUB_OUTPUT
       - name: Publish 🚀
         shell: bash
         run: |
           pushd packages/${{ inputs.package }}
-          pnpm publish --tag ${{ inputs.tag }} --access public --no-git-checks
+          pnpm publish --provenance --tag ${{ inputs.tag }} --access public --no-git-checks ${{ inputs.dry_run && '--dry-run' || '' }}
+      - name: Tag release
+        if: ${{ !inputs.dry_run }}
+        run: |
+          git tag ${{ steps.pkg.outputs.tag }}
+          git push origin ${{ steps.pkg.outputs.tag }}