chore: Add permissions for GitHub Actions workflows

- Updated publish-prerelease.yml and publish-stable-release.yml to include permissions for reading contents and writing id-token.
- Modified service_publish-node-package.yml to add permissions for the publish job, ensuring proper access for trusted publishing.

Author: jaydrogers

.github/workflows/publish-prerelease.yml

@@ -5,6 +5,10 @@ on:
   release:
     types: [prereleased]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   publish-prerelease:
     uses: ./.github/workflows/service_publish-node-package.yml

.github/workflows/publish-stable-release.yml

@@ -5,6 +5,10 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   publish-stable-release:
     uses: ./.github/workflows/service_publish-node-package.yml

.github/workflows/service_publish-node-package.yml

@@ -15,6 +15,9 @@ on:
 
 jobs:
     publish:
+      permissions:
+        contents: read
+        id-token: write
       runs-on: ${{ inputs.runs-on }}
 
       steps:
@@ -26,11 +29,13 @@ jobs:
 
       - name: checkout
         uses: actions/checkout@v6
+
+      # Trusted publishing (OIDC) requires npm CLI >= 11.5.1 (Node images may ship older npm).
+      - name: Upgrade npm for OIDC trusted publishing
+        run: npm install -g npm@^11.5.1
 
       - name: Set NPM version (${{ github.ref_name }}).
         run: npm version --git-tag-version=false --commit-hooks=false ${{ github.ref_name }}
 
       - name: Publish release (${{ inputs.release-tag }})
-        run: npm publish --access public --tag ${{ inputs.release-tag }}
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN_SECRET}}
+        run: npm publish --access public --tag ${{ inputs.release-tag }}