Merge pull request #457 from geolonia/add-oidc-publising

Remove token based npm publish

Author: bougan1160

.github/workflows/build.yml

@@ -86,6 +86,9 @@ jobs:
   publish:
     name: 'Publish npm package'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     needs:
       - build
       - act-test
@@ -102,16 +105,18 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           name: the-built
+
+      - name: Update npm
+        run: npm install -g npm@latest
+
       - name: 'Publish to NPM (latest)'
         if: "!contains(github.ref, '-pre.')"
         run: npm publish --access=public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
       - name: 'Publish to NPM (next)'
         if: "contains(github.ref, '-pre.')"
         run: npm publish --access=public --tag=next
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
   deploy:
     needs: build
     runs-on: ubuntu-latest