Merge pull request #724 from knowledge-work/trusted-publisher

trusted publisher

Author: otofu-square

.github/renovate.json5

@@ -9,4 +9,5 @@
   ],
   timezone: 'Asia/Tokyo',
   postUpdateOptions: ['yarnDedupeHighest'],
+  minimumReleaseAge: '7 days',
 }

.github/workflows/publish.yml

@@ -17,6 +17,10 @@ concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write # Required for OIDC
+  contents: write # create tag and release
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -32,6 +36,10 @@ jobs:
           cache: 'pnpm'
           registry-url: 'https://registry.npmjs.org'
 
+      # Trusted publishing requires npm CLI version 11.5.1 or later.
+      - name: Ensure npm >= 11.5.1
+        run: npm i -g npm@^11.5.1
+
       - name: Install dependencies
         run: pnpm i --frozen-lockfile
 
@@ -43,8 +51,6 @@ jobs:
           pnpm version ${{ github.event_name == 'schedule' && 'patch' || github.event.inputs.versionClass }}
           pnpm release
           echo "new_version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Create release
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

package.json

@@ -33,7 +33,7 @@
     "format": "prettier --write .",
     "release": "pnpm release:check && pnpm release:publish",
     "release:check": "echo \"Run check for version $npm_package_version\" && pnpm check",
-    "release:publish": "git push --tags && git push origin main && pnpm publish ."
+    "release:publish": "npm publish . && git push origin main && git push --tags"
   },
   "dependencies": {
     "@eslint/eslintrc": "3.3.1",