ci: add npm trusted publishing to release workflow

Author: gitlayzer

.github/workflows/release.yml

@@ -8,6 +8,7 @@ on:
 permissions:
   contents: write
   packages: write
+  id-token: write
 
 jobs:
   goreleaser:
@@ -44,7 +45,7 @@ jobs:
         uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -93,3 +94,37 @@ jobs:
             VERSION=${{ steps.vars.outputs.version }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  npm-publish:
+    runs-on: ubuntu-latest
+    needs:
+      - goreleaser
+      - docker
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Verify npm trusted publishing prerequisites
+        run: |
+          node --version
+          npm --version
+          node --check scripts/build-npm-packages.mjs
+
+      - name: Publish npm packages
+        env:
+          NPM_VERSION: ${{ github.ref_name }}
+          NPM_RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          export NPM_VERSION="${NPM_VERSION#v}"
+          make npm-publish