Merge pull request #2681 from srod/develop

chore: setup npm trusted publishing with OIDC and provenance

Author: srod

.github/workflows/publish.yml

@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  id-token: write
   contents: write
   pull-requests: write
 
@@ -26,6 +27,15 @@ jobs:
       - name: 📦 Setup Bun
         uses: oven-sh/setup-bun@v2
 
+      - name: ⚙️ Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: 🔧 Upgrade npm for OIDC support
+        run: npm install -g npm@latest
+
       - name: 📥 Install dependencies
         run: bun install --frozen-lockfile
 
@@ -38,4 +48,3 @@ jobs:
           createGithubReleases: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -36,7 +36,7 @@
     "test:coverage": "vitest run --coverage",
     "changeset": "changeset",
     "changeset:version": "changeset version && bun install --no-frozen-lockfile",
-    "changeset:release": "bun run build && changeset publish",
+    "changeset:release": "bun run build && changeset publish --provenance",
     "format:check": "bun run --filter '*' format:check",
     "format": "biome check --write .",
     "typecheck": "bun run --filter '*' typecheck"