chore(release): enhance release workflow and npm configuration for secure publishing

- following github guide: https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/
- following npm guide: https://docs.npmjs.com/trusted-publishers#supported-cicd-providers
- following semantic-release guide: https://semantic-release.gitbook.io/semantic-release/recipes/ci-configurations/github-actions

Author: SimonGolms

.github/workflows/release.yml

@@ -7,26 +7,35 @@ on:
       - next
       - feature/**
 
+permissions:
+  contents: read # for checkout
+
 jobs:
   release:
     env:
       # Disable husky (git hooks) in CI, see: https://typicode.github.io/husky/#/?id=disable-husky-in-cidocker
       HUSKY: 0
     name: Release
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
+          cache: npm
           node-version-file: '.nvmrc'
           registry-url: https://registry.npmjs.org/
-          cache: npm
       - name: Install Dependencies
         run: npm clean-install
+      - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
+        run: npm audit signatures
       - name: Release package to npm and GitHub
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm run release:ci

.npmrc

@@ -1,6 +1,3 @@
 //registry.npmjs.org/:_authToken=${NPM_TOKEN}
 
 @boehringer-ingelheim:registry=https://registry.npmjs.org/
-
-access=public
-always-auth=true

package.json

@@ -21,6 +21,11 @@
   "bugs": {
     "url": "https://github.com/Boehringer-Ingelheim/eslint-config/issues"
   },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true,
+    "registry": "https://registry.npmjs.org/"
+  },
   "files": [
     "configs",
     "lib",