Better (and more secure?) workflow file?

Author: barbarbar338

.github/workflows/publish.yml

@@ -1,20 +1,45 @@
-name: Publish Package to NPM
+name: Publish to npm
 
-on: [push]
+on:
+  release:
+    types: [published]
 
 jobs:
-    build:
-        name: "Build & Publish"
-        runs-on: ubuntu-latest
-        if: "contains(github.event.head_commit.message, '(publish)')"
-        steps:
-            - uses: actions/checkout@v6
-            - uses: actions/setup-node@v6
-              with:
-                  node-version: "24.x"
-                  registry-url: "https://registry.npmjs.org"
-            - run: npm install
-            - run: npm run build
-            - run: npm publish
-              env:
-                  NODE_AUTH_TOKEN: ${{ secrets.NPM_SECRET_TOKEN }}
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: ⎔ Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: "npm"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: 📦 Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: 🛠 Build
+        run: npm run build
+
+      - name: 🏷️ Extract version from tag
+        id: get_version
+        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+
+      - name: 🚫 Stop if not version tag
+        if: "!startsWith(github.ref, 'refs/tags/v')"
+        run: |
+          echo "Not a version tag → skipping publish"
+          exit 1
+
+      - name: 🔐 NPM publish
+        run: |
+          npm publish --provenance --access public

package.json

@@ -20,7 +20,7 @@
 	},
 	"main": "dist",
 	"name": "reaction-role",
-	"version": "5.2.0",
+	"version": "5.2.1",
 	"description": "ReactionRole is a module that allows you to create Discord reaction role easily!",
 	"scripts": {
 		"prebuild": "rimraf dist",