fix: release and publish (#441)

<!--
Thank you for proposing a pull request! Please note that SOME TESTS WILL
LIKELY FAIL due to how GitHub exposes secrets in Pull Requests from
forks.
Someone from the team will review your Pull Request and respond.

Please describe your change and any implementation details below.
-->

Author: verbanicm

.github/workflows/publish.yml

@@ -11,7 +11,24 @@ jobs:
     if: |-
       startsWith(github.event.head_commit.message, 'Release: v')
     name: 'Release'
-    uses: 'google-github-actions/.github/.github/workflows/release.yml@v1' # ratchet:exclude
-    # secrets must be explicitly passed to reusable workflows https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows#using-inputs-and-secrets-in-a-reusable-workflow
-    secrets:
-      ACTIONS_BOT_TOKEN: '${{ secrets.ACTIONS_BOT_TOKEN }}'
+    uses: 'google-github-actions/.github/.github/workflows/release.yml@v0' # ratchet:exclude
+
+  publish:
+    if: |-
+      startsWith(github.event.head_commit.message, 'Release: v')
+    runs-on: 'ubuntu-latest'
+    needs: 'release'
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+      packages: 'write'
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871' # ratchet:actions/checkout@v4
+
+      - name: 'Publish'
+        id: 'publish'
+        uses: 'actions/publish-immutable-action@4b1aa5c1cde5fedc80d52746c9546cb5560e5f53' # ratchet:actions/[email protected]
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'

.github/workflows/release.yml

@@ -1,6 +1,6 @@
 {
   "name": "@google-github-actions/deploy-cloud-functions",
-  "version": "3.0.6",
+  "version": "3.0.5",
   "description": "Deploy a Cloud Function",
   "main": "dist/index.js",
   "scripts": {