ci: enable npm trusted publishing with OIDC (#47)

Author: cwandev

.github/workflows/release.yaml

@@ -1,45 +1,43 @@
-# .github/workflows/release.yml
-
 name: Release
 
-permissions:
-  contents: write
-
 on:
   push:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+  id-token: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
+      - name: Check out repository
         uses: actions/checkout@v6
-
-      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
         with:
-          node-version: 18.x
+          node-version: 24.x
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
 
-      - run: npx changelogithub
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+      - name: Install dependencies
+        run: pnpm i --frozen-lockfile
 
-  npm:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
+      - name: Build packages
+        run: pnpm build
 
-      - name: Setup (Install node & pnpm)
-        uses: ./.github/actions/setup
+      - name: Stage packages/core on npm
+        run: pnpm pub:release
 
-      - name: Build Packages & Publish to npm
-        run: pnpm build && pnpm pub:release
+      - name: Generate GitHub Release notes
+        run: pnpm dlx changelogithub
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

packages/core/package.json

@@ -47,7 +47,7 @@
     "type-check": "vue-tsc -p tsconfig.check.json --noEmit",
     "test": "vitest",
     "test-update": "vitest -u",
-    "pub:release": "pnpm publish --no-git-checks --access public"
+    "pub:release": "pnpm stage publish --no-git-checks --access public"
   },
   "peerDependencies": {
     "vue": ">= 3.5.0"