github: Fix npm publishing

Switch to trusted publishing.

Author: penberg

.github/workflows/publish.yml

@@ -13,9 +13,11 @@ jobs:
     name: "Publish new version to NPM"
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
+      id-token: write
     env:
       NODE_OPTIONS: "--trace-warnings"
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
         - name: "Checkout this repo"
           uses: actions/checkout@v3
@@ -31,27 +33,26 @@ jobs:
 
         - name: "Publish core (pre-release)"
           if: contains(github.ref, '-pre')
-          run: npm publish --tag next
+          run: npm publish --tag next --provenance --access public
           working-directory: ./packages/libsql-core
 
         - name: "Publish core (latest)"
           if: "!contains(github.ref, '-pre')"
-          run: npm publish
+          run: npm publish --provenance --access public
           working-directory: ./packages/libsql-core
 
-
         - name: "Install npm dependencies (client)"
           run: "npm ci"
           working-directory: ./packages/libsql-client
 
         - name: "Publish client (pre-release)"
           if: contains(github.ref, '-pre')
-          run: npm publish --tag next
+          run: npm publish --tag next --provenance --access public
           working-directory: ./packages/libsql-client
 
         - name: "Publish client (latest)"
           if: "!contains(github.ref, '-pre')"
-          run: npm publish
+          run: npm publish --provenance --access public
           working-directory: ./packages/libsql-client
 
 
@@ -61,10 +62,10 @@ jobs:
 
         - name: "Publish client-wasm (pre-release)"
           if: contains(github.ref, '-pre')
-          run: npm publish --tag next
+          run: npm publish --tag next --provenance --access public
           working-directory: ./packages/libsql-client-wasm
 
         - name: "Publish client-wasm (latest)"
           if: "!contains(github.ref, '-pre')"
-          run: npm publish
+          run: npm publish --provenance --access public
           working-directory: ./packages/libsql-client-wasm