Use trusted publishing

Author: razor-x

.github/workflows/_publish.yml

@@ -15,7 +15,7 @@ on:
     secrets:
       registry_token:
         description: The package registry token.
-        required: true
+        required: false
 
 jobs:
   publish:
@@ -24,21 +24,21 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Setup
         uses: ./.github/actions/setup
         with:
           install_dependencies: 'false'
       - name: Download artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: ${{ inputs.artifact_name }}
           path: .
       - name: Get meta
         id: meta
         run: echo "tgz=$(ls *.tgz | head -n1)" >> $GITHUB_OUTPUT
       - name: Publish
-        uses: JS-DevTools/npm-publish@v3
+        uses: JS-DevTools/npm-publish@v4
         with:
           access: public
           token: ${{ secrets.registry_token }}

.github/workflows/publish.yml

@@ -19,11 +19,11 @@ jobs:
     needs: build
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Download artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: ${{ needs.build.outputs.artifact_name }}
           path: .
@@ -47,11 +47,12 @@ jobs:
     name: npm
     uses: ./.github/workflows/_publish.yml
     needs: build
+    permissions:
+      contents: read
+      id-token: write
     with:
       artifact_name: ${{ needs.build.outputs.artifact_name }}
       registry_url: https://registry.npmjs.org
-    secrets:
-      registry_token: ${{ secrets.NPM_TOKEN }}
   github:
     name: GitHub Packages
     uses: ./.github/workflows/_publish.yml