fix: npm provenance (#37)

Enable OIDC for trusted publishing and npm provenance.

Author: DoneDeal0

.github/workflows/cd.yml

@@ -9,14 +9,12 @@ on:
       - main
 
 jobs:
-  publish:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+  release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
       issues: write
       pull-requests: write
-      id-token: write
 
     steps:
       - name: Checkout
@@ -29,15 +27,16 @@ jobs:
         with:
           node-version: "24"
           cache: "npm"
+          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Build the project
+      - name: Build
         run: npm run build
 
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release

.github/workflows/ci.yml

@@ -21,6 +21,7 @@ jobs:
         with:
           node-version: "24"
           cache: "npm"
+          registry-url: https://registry.npmjs.org
 
       - name: Install dependencies
         run: npm ci