ci: fix npm publish via OIDC trusted publishing (#8)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Belco90

.github/workflows/ci.yml

@@ -20,11 +20,11 @@ jobs:
           - test
           - build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: pnpm

.github/workflows/release-please.yml

@@ -16,7 +16,7 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
         id: release
         with:
           config-file: release-please-config.json
@@ -30,26 +30,24 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org
           cache: pnpm
 
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Type check
-        run: pnpm type-check
+      - name: Upgrade npm for OIDC trusted publishing
+        run: npm install -g npm@~11.10.0
 
-      - name: Build
-        run: pnpm build
+      - name: Install dependencies
+        run: pnpm install
 
+      # Build happens in `prepublishOnly+
       - name: Publish to npm
-        run: pnpm publish --provenance --access public --no-git-checks --ignore-scripts
+        run: npm publish --provenance --access public --ignore-scripts