chore(ci): trusted publisher

Author: x3zvawq

.github/workflows/npmpkg.yml

@@ -10,13 +10,15 @@ jobs:
     publish-npm:
         # needs: build
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
         steps:
-            - uses: actions/checkout@v2
-            - uses: actions/setup-node@v1
+            # npmjs 发布走 npm trusted publisher(OIDC)，这里不要再传 NPM_TOKEN。
+            - uses: actions/checkout@v6
+            - uses: actions/setup-node@v6
               with:
-                  node-version: 12
+                  node-version: 24
                   registry-url: https://registry.npmjs.org/
             # - run: npm ci
-            - run: npm publish --access public
-              env:
-                  NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+            - run: npm publish --provenance --access public

package.json

@@ -48,5 +48,9 @@
         "> 1%",
         "last 2 versions",
         "not dead"
-    ]
+    ],
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/JX3BOX/jx3box-map.git"
+    }
 }