ci(release): migrate publish to npm trusted publishing via OIDC

.github/workflows/autopublish.yml → .github/workflows/bump.yml

@@ -1,13 +1,13 @@
-name: "AutoPublish"
+name: "Bump version"
 
 on:
   push:
     branches:
       - "master"
 
 jobs:
-  auto-publish:
-    name: "AutoPublish on master"
+  bump:
+    name: "Bump version on master"
     runs-on: ubuntu-latest
     if: "!startsWith(github.event.head_commit.message, 'chore: bump version to')"
 
@@ -19,7 +19,7 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
       - name: "Checkout source code"
-        uses: "actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd"  # v5
+        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
       - name: "Automated Release"
@@ -28,12 +28,3 @@ jobs:
           commit-message: 'chore: bump version to {{version}}'
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
-        with:
-          node-version: '18'
-          registry-url: 'https://registry.npmjs.org'
-      - name: "Install dependencies"
-        run: npm install
-      - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}

.github/workflows/publish.yml

@@ -0,0 +1,25 @@
+name: "Publish to npm"
+
+on:
+  push:
+    tags:
+      - "*.*.*"
+
+jobs:
+  publish:
+    name: "Publish to npm"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+      - run: npm ci
+      - run: npm test
+      - run: npm publish --access public