chore: add OIDC Trusted Publisher for NPM

.github/workflow/npm-publish.yaml → .github/workflows/npm-publish.yaml

@@ -6,6 +6,10 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 jobs:
   release-cli-if-necessary:
     runs-on: ubuntu-latest
@@ -14,11 +18,15 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
+      # Ensure npm 11.5.1 or later is installed
+      - name: Update npm
+        run: npm install -g npm@^11.5.1
+
       - name: Install dependencies 📥
         run: npm ci
 
@@ -39,6 +47,4 @@ jobs:
 
       - name: Publish package on NPM 📦
         if: steps.is-release-needed.outputs.is-release-needed == 'true'
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.REQUEST_BOT_NPM_TOKEN }}
+        run: npm publish --provenance

package.json

@@ -18,6 +18,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.4.1",
+    "@types/prettier": "^2.7.3",
     "typescript": "^5.5.4"
   }
 }