ci: update npm before trusted publish

Author: narumiruna

.github/workflows/publish.yml

@@ -29,13 +29,20 @@ jobs:
           registry-url: "https://registry.npmjs.org"
           cache: npm
 
+      - name: Update npm for OIDC publishing
+        run: |
+          npm install -g npm@latest
+          npm --version
+
       - name: Install dependencies
         run: npm ci
 
       - name: Verify packages
         run: npm run check
 
       - name: Publish unpublished workspace packages
+        env:
+          NPM_CONFIG_PROVENANCE: "true"
         run: |
           set -euo pipefail
 
@@ -68,5 +75,5 @@ jobs:
             fi
 
             echo "Publishing ${package}@${version}..."
-            npm --workspace "$package" publish --access public --provenance
+            npm --workspace "$package" publish --access public --loglevel verbose
           done < /tmp/pi-workspaces.tsv