chore/trusted publisher (#6)

Author: philsturgeon

.github/workflows/release.yml

@@ -14,8 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      issues: write
-      pull-requests: write
       id-token: write
 
     steps:
@@ -44,4 +42,3 @@ jobs:
         run: npm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.releaserc.json

@@ -26,7 +26,13 @@
         "npmPublish": true
       }
     ],
-    "@semantic-release/github",
+    [
+      "@semantic-release/github",
+      {
+        "successComment": false,
+        "failComment": false
+      }
+    ],
     [
       "@semantic-release/git",
       {

CONTRIBUTING.md

@@ -68,10 +68,3 @@ Releases are automated with semantic-release via GitHub Actions on pushes to `ma
 
 - Commits should follow Conventional Commits (`feat:`, `fix:`, `feat!:`) so the next version can be calculated correctly.
 - The workflow publishes to npm and creates a GitHub release and tag like `v2.1.0`.
-- Configure repository secret `NPM_TOKEN` with publish access to `@apisyouwonthate/spectral-jsonapi`.
-
-You can test release logic locally in dry-run mode:
-
-```bash
-npm run release -- --dry-run --no-ci
-```