ci: publish to npm with trusted publishing (OIDC)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Snailedlt

.github/workflows/npm_publish.yml

@@ -2,22 +2,31 @@ name: "Publish to npm"
 on:
   release:
     types: [released]
+  # Allows re-running a failed publish by hand from the Actions tab
+  workflow_dispatch:
+permissions: {}
 jobs:
   publish:
     environment: release
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # Required for npm trusted publishing (OIDC)
+      contents: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # "ref" specifies the branch to check out.
           # "github.event.release.target_commitish" is a global variable and specifies the branch the release targeted
+          # It's empty on manual runs, so the branch selected in the Actions tab is used instead
           ref: ${{ github.event.release.target_commitish }}
-      - name: Use Node.js v16
-        uses: actions/setup-node@v4
+          persist-credentials: false
+      # Node 24 ships with npm 11.5.1 or later, which trusted publishing requires
+      - name: Use Node.js v24
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          registry-url: https://registry.npmjs.org/ # Specifies the registry, this field is required!
-      - run: npm ci
+          package-manager-cache: false
+      # No dependencies are installed: the package has no build step, and skipping
+      # them keeps third-party install scripts out of the job that can publish.
+      # Authenticates through the trusted publisher configured on npmjs.com, so no token is needed
       - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }}