Migrate to NPM trusted publishing

[Copilot]

Replaces NPM_TOKEN secret authentication with OIDC-based trusted publishing for npm registry. GitHub Packages publishing remains unchanged.

Changes

• setup-node: Upgraded to v6 with npm@11.5.1 for trusted publisher support
• Publish job: Added id-token: write permission, removed NPM_TOKEN configuration step, set NODE_AUTH_TOKEN="" for npm publish
• Version: Bumped to 6.1.3

Publishing Flow

# Before: Token-based
- name: Configure npm authentication
  run: pnpm config set //registry.npmjs.org/:_authToken "${{ secrets.NPM_TOKEN }}"
- name: Publish to npm
  run: pnpm publish

# After: OIDC-based trusted publishing
- name: Publish to npm
  run: pnpm publish
  env:
    NODE_AUTH_TOKEN: ""

GitHub Packages continues using GITHUB_TOKEN as before.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>@copilot use npm trusted publishing</issue_title>
<issue_description>- make sure we use actions/setup-node@v6, not older versions

• after calling setup-node, run this code:

    # See: https://docs.npmjs.com/trusted-publishers
    # See: https://github.com/actions/setup-node/issues/1445
    - name: Set npm to version that supports trusted publishers
      run: npm install -g npm@11.5.1
      shell: bash

• set permissions on the github workflow to:

permissions:
  id-token: write
  contents: read
  packages: write

• when calling pnpm publish to npm, set NODE_AUTH_TOKEN=""
• bump the version in package.json
• remove npm authentication using NPM_TOKEN, such as:

  - name: Configure npm authentication
        run: |
          pnpm config set always-auth true
          pnpm config set //registry.npmjs.org/:_authToken "${{ secrets.NPM_TOKEN }}"

This should only be removed for npm publishing, not to github packages</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes @copilot use npm trusted publishing #152

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[dmattia]

updated: https://www.npmjs.com/package/@transcend-io/conflux/access