feat: trusted publishing

Signed-off-by: Berend Sliedrecht <berend@animo.id>

Author: berendsliedrecht

.github/workflows/release.yml

@@ -7,33 +7,30 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: write
+  id-token: write # Needed for npm trusted publishing
+  pull-requests: write
+
 jobs:
   release-stable:
     runs-on: ubuntu-24.04
     name: Release Stable
-    permissions:
-      contents: write
-      id-token: write # Required for npm trusted publishing
-      pull-requests: write
     outputs:
       published: ${{ steps.changesets.outputs.published }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - uses: pnpm/action-setup@v4
-
       - name: Setup NodeJS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22
           cache: "pnpm"
-          registry-url: "https://registry.npmjs.org"
 
-      # Ensure npm >= 11.5.1 for trusted publishing support.
-      # Automatically fetch future security updates
       - name: Update npm
-        run: npm install -g npm@^11.5.1
+        run: npm install -g npm@^11
 
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
@@ -64,27 +61,19 @@ jobs:
     name: Release Unstable
     needs: release-stable
     if: always() && github.event_name == 'push' && needs.release-stable.outputs.published == 'false'
-    permissions:
-      contents: write
-      id-token: write # Required for npm trusted publishing
-      pull-requests: write
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - uses: pnpm/action-setup@v4
-
       - name: Setup NodeJS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: "pnpm"
-          registry-url: "https://registry.npmjs.org"
 
-      # Ensure npm >= 11.5.1 for trusted publishing support.
-      # Automatically fetch future security updates
       - name: Update npm
-        run: npm install -g npm@^11.5.1
+        run: npm install -g npm@^11
 
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile