ci: set up npm trusted publishing

Publish to npm via GitHub Actions OIDC instead of a long-lived
NPM_TOKEN secret.

- Bump semantic-release 17 -> 25, which pulls in @semantic-release/npm
  v13. OIDC token exchange landed in @semantic-release/npm v13.1.0, and
  v13 bundles npm 11.x (trusted publishing needs npm >= 11.5.1).
- Move the release out of the test matrix into its own job so that
  `id-token: write` is scoped to the publish step only, and grant the
  permissions semantic-release needs now that the workflow declares an
  explicit permissions block.
- Drop the NPM_TOKEN env var. With trusted publishing configured,
  @semantic-release/npm exchanges the Actions OIDC token for a
  short-lived registry token and never reads NPM_TOKEN.
- Add publishConfig.access=public so the scoped package keeps publishing
  publicly, and bump CI to Node 22 because semantic-release v25 requires
  ^22.14.0 || >=24.10.0 (yarn v1 hard-fails on engine mismatch).

Provenance attestations are generated automatically for public packages
published from a public repo via OIDC, so no --provenance flag is needed.

Co-Authored-By: Steven <229881+styfle@users.noreply.github.com>

Author: vercel[bot]

.github/workflows/ci.yml

@@ -8,14 +8,17 @@ on:
       - "!*"
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Node ${{ matrix.node }} and ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        node: [18]
+        node: [22]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
@@ -38,9 +41,28 @@ jobs:
       - name: Coverage
         if: matrix.os == 'ubuntu-latest'
         run: yarn test-coverage
+
+  release:
+    name: Release
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to create the GitHub release and push the tag
+      issues: write # to comment on released issues
+      pull-requests: write # to comment on released pull requests
+      id-token: write # to use OIDC for npm trusted publishing and provenance
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install Dependencies
+        run: yarn install
       - name: Release
-        if: matrix.os == 'ubuntu-latest' && matrix.node == 18 && github.event_name == 'push' && github.ref == 'refs/heads/main'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN_ELEVATED }}
         run: yarn semantic-release

package.json

@@ -13,6 +13,9 @@
   "files": [
     "src/*"
   ],
+  "publishConfig": {
+    "access": "public"
+  },
   "dependencies": {
     "@mapbox/node-pre-gyp": "^2.0.0",
     "acorn": "^8.3.0",
@@ -35,7 +38,7 @@
     "@vercel/ncc": "^0.38.1",
     "jest": "^26.6.3",
     "memory-fs": "^0.4.1",
-    "semantic-release": "^17.3.0",
+    "semantic-release": "^25.0.9",
     "socket.io-client": "^2.2.0",
     "webpack": "^5",
     "webpack-cli": "^4"