ci: Publish releases using OIDC instead of npm token

Author: seb-cr

.github/workflows/main.yml

@@ -75,6 +75,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: unit-test
     if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/beta'
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for trusted publishing and npm provenance
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -83,6 +88,9 @@ jobs:
         with:
           node-version: 22
 
+      - name: Update npm # Trusted Publishing requires npm >=11.5.1
+        run: npm i -g npm@latest
+
       - name: Restore cache
         uses: actions/cache@v4
         with:
@@ -96,4 +104,3 @@ jobs:
         run: yarn semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_PUBLISHING_TOKEN }}

package.json

@@ -38,7 +38,7 @@
     "expect-type": "^0.18.0",
     "jest": "^29.7.0",
     "nyc": "^15.1.0",
-    "semantic-release": "^19.0.5",
+    "semantic-release": "^25.0.3",
     "ts-jest": "29.1.1",
     "ts-node": "^10.9.2",
     "tsconfig-paths": "^4.2.0",