ci: use npm OIDC trusted publishing with provenance for releases

Author: drewstone

.github/workflows/release.yml

@@ -12,6 +12,8 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      # Required for npm OIDC trusted publishing (tokenless) + provenance.
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -21,11 +23,14 @@ jobs:
           cache: pnpm
           registry-url: https://registry.npmjs.org
       - run: pnpm install --frozen-lockfile
+      # npm OIDC trusted publishing requires npm >= 11.5.1; node 22 ships an older npm.
+      - run: npm install -g npm@latest
       - uses: changesets/action@v1
         with:
           version: pnpm changeset:version
           publish: pnpm changeset:publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # Auth comes from OIDC (id-token) once the package's trusted publisher
+          # is registered on npmjs.com. Provenance is attached automatically.
+          NPM_CONFIG_PROVENANCE: "true"