chore(publishing): use oidc

Author: avivkeller

.github/workflows/publish-packages.yml

@@ -5,18 +5,20 @@ name: Publish Packages
 on:
   push:
     paths:
-      - 'packages/**'
+      - "packages/**"
     # For security reasons, this should never be set to anything but `main`
     branches: [main]
   workflow_dispatch:
     inputs:
       package:
-        description: 'Specific package to publish (leave empty for all packages)'
+        description: "Specific package to publish (leave empty for all packages)"
         required: false
         type: string
 
 permissions:
   contents: read
+  # For npm OIDC (https://docs.npmjs.com/trusted-publishers)
+  id-token: write
 
 env:
   COMMIT_SHA: ${{ github.sha }}
@@ -110,13 +112,11 @@ jobs:
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           # Don't use caching here as we never install dependencies in this workflow
-          node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
+          node-version-file: ".nvmrc"
+          registry-url: "https://registry.npmjs.org"
 
       - name: Publish
         working-directory: packages/${{ matrix.package }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           # Install deps
           pnpm install --frozen-lockfile
@@ -134,9 +134,9 @@ jobs:
         if: ${{ github.event_name == 'workflow_dispatch' }}
         uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # 2.3.3
         env:
-          SLACK_COLOR: '#43853D'
+          SLACK_COLOR: "#43853D"
           SLACK_ICON: https://github.com/nodejs.png?size=48
-          SLACK_TITLE: ':rocket: Package Published: ${{ matrix.package }}'
+          SLACK_TITLE: ":rocket: Package Published: ${{ matrix.package }}"
           SLACK_MESSAGE: |
             :package: *Package*: `${{ matrix.package }}` (<https://www.npmjs.com/package/@node-core/${{ matrix.package }}|View on npm>)
             :bust_in_silhouette: *Published by*: ${{ github.triggering_actor }}