Use OIDC for npm publish (#130)

* Use OIDC for npm publish

* Apply suggestion from @jakubno

* Update node

Author: jakubno

.github/workflows/publish_packages.yml

@@ -5,12 +5,11 @@ on:
     secrets:
       E2B_API_KEY:
         required: true
-      NPM_TOKEN:
-        required: true
       PYPI_TOKEN:
         required: true
 
 permissions:
+  id-token: write
   contents: write
 
 jobs:
@@ -46,17 +45,23 @@ jobs:
         with:
           version: 9.5
 
-      - name: Setup Node.js 20
-        uses: actions/setup-node@v3
+      - name: Setup Node.js 22
+        uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
+          node-version: "22.x"
+          registry-url: "https://registry.npmjs.org"
           cache: pnpm
 
       - name: Configure pnpm
         run: |
           pnpm config set auto-install-peers true
           pnpm config set exclude-links-from-lockfile true
 
+      - name: Update npm
+        run: |
+          npm install -g npm@^11.6
+          npm --version
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -84,8 +89,8 @@ jobs:
           createGithubReleases: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+          NPM_TOKEN: "" # See https://github.com/changesets/changesets/issues/1152#issuecomment-3190884868
 
       - name: Update lock file
         run: pnpm i --no-link --no-frozen-lockfile

.github/workflows/release.yml

@@ -8,6 +8,7 @@ on:
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 permissions:
+  id-token: write
   contents: write
 
 jobs:
@@ -27,10 +28,10 @@ jobs:
           version: 9.5
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
+          node-version: "22.x"
+          registry-url: "https://registry.npmjs.org"
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
 
@@ -67,9 +68,9 @@ jobs:
           version: 9.5
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
+          node-version: '22.x'
           registry-url: 'https://registry.npmjs.org'
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml