Set up OIDC publishing

Author: eddeee888

.github/workflows/snapshot.yml

@@ -5,7 +5,7 @@ on:
     types: [created]
 
 env:
-  npm-token: ${{ secrets.NPM_TOKEN }}
+  # npm-token: ${{ secrets.NPM_TOKEN }}
   github-token: ${{ secrets.GITHUB_TOKEN }}
   node-version: '22.x'
   release-tag: pr${{ github.event.issue.number }}-run${{ github.run_number }}-${{ github.run_attempt }}
@@ -57,7 +57,9 @@ jobs:
     runs-on: ubuntu-24.04
     needs: release-check
     permissions:
-      pull-requests: write
+      id-token: write # allows ODIC publishing
+      contents: read
+      pull-requests: write # allows posting a message to the PR about success/error
     if: needs.release-check.outputs.triggered == 'true'
     steps:
       - name: Get Pull Request ref
@@ -76,23 +78,25 @@ jobs:
         with:
           persist-credentials: true
           repository: ${{ fromJson(steps.get_pull_request_ref.outputs.data).head.repo.full_name }}
-          ref: ${{ fromJson(steps.get_pull_request_ref.outputs.data).head.ref }}
+          # ref: ${{ fromJson(steps.get_pull_request_ref.outputs.data).head.ref }}
+          ref: refs/pull/${{ github.event.issue.number }}/head
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
           node-version: ${{ env.node-version }}
+          registry-url: 'https://registry.npmjs.org'
           cache: yarn
           cache-dependency-path: '**/yarn.lock'
 
       - name: Install deps
         run: yarn install --prefer-offline
 
-      - name: Configure NPM
-        run: |
-          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
-        env:
-          NPM_TOKEN: ${{ env.npm-token }}
+      # - name: Configure NPM
+      #   run: |
+      #     echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
+      #   env:
+      #     NPM_TOKEN: ${{ env.npm-token }}
 
       - name: Deploy snapshot
         run: |