ci: use OIDC for npm publishing (#2554)

Author: SamuelAlev

.github/workflows/continuous-deployment.yaml

@@ -15,13 +15,13 @@ jobs:
 
         steps:
             - name: Checkout default branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
 
             - name: Use pnpm
-              uses: pnpm/action-setup@v3
+              uses: pnpm/action-setup@v4.2.0
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version-file: ".nvmrc"
                   cache: "pnpm"
@@ -54,13 +54,13 @@ jobs:
 
         steps:
             - name: Checkout default branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
 
             - name: Use pnpm
-              uses: pnpm/action-setup@v3
+              uses: pnpm/action-setup@v4.2.0
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version-file: ".nvmrc"
                   cache: "pnpm"
@@ -98,15 +98,15 @@ jobs:
 
         steps:
             - name: Checkout current commit
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version-file: ".nvmrc"
 
             - name: Use pnpm
-              uses: pnpm/action-setup@v3
+              uses: pnpm/action-setup@v4.2.0
               with:
                   run_install: false
 
@@ -149,15 +149,15 @@ jobs:
 
         steps:
             - name: Checkout current commit
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
 
             - name: Use pnpm
-              uses: pnpm/action-setup@v3
+              uses: pnpm/action-setup@v4.2.0
               with:
                   run_install: false
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version-file: ".nvmrc"
                   cache: "pnpm"
@@ -190,16 +190,17 @@ jobs:
         permissions:
             contents: write # to create release (changesets/action)
             pull-requests: write # to create pull request (changesets/action)
+            id-token: write # to authenticate with npm registry via OIDC
 
         steps:
             - name: Checkout default branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@v6
 
             - name: Use pnpm
-              uses: pnpm/action-setup@v3
+              uses: pnpm/action-setup@v4.2.0
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v6
               with:
                   node-version-file: ".nvmrc"
                   cache: "pnpm"
@@ -217,4 +218,6 @@ jobs:
                   publish: pnpm ci:publish
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-                  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+                  NPM_CONFIG_PROVENANCE: true
+                  # Use OIDC for npm authentication instead of NPM_TOKEN
+                  NPM_TOKEN: "" # https://github.com/changesets/changesets/issues/1152#issuecomment-3190884868