fix: Update permissions and streamline npm configuration in release workflows

Author: RomanNabukhotnyi

.github/workflows/release-feature-branch.yaml

@@ -340,15 +340,15 @@ jobs:
       - uses: actions/setup-node@v6
         with: { node-version: '24', cache: 'pnpm', cache-dependency-path: pnpm-lock.yaml }
       - run: pnpm install --frozen-lockfile --prefer-offline
-
-      # nuke, so npm can use OIDC
-      - name: Remove temp npmrc
-        run: rm -f "$NPM_CONFIG_USERCONFIG"
 
       # >= 11.5.1 for trusted publishing
       - name: Update NPM
         run: npm install -g npm@latest
 
+      # nuke, so npm can use OIDC
+      - name: Remove temp npmrc
+        run: rm -f "$NPM_CONFIG_USERCONFIG"
+
       - name: Check preconditions
         id: checks
         shell: bash
@@ -384,9 +384,6 @@ jobs:
         shell: bash
         run: npm run pack
 
-      # nuke, so npm can use OIDC
-      - name: Remove temp npmrc
-        run: rm -f "$NPM_CONFIG_USERCONFIG"
       - name: Publish
         if: github.event_name == 'push' && steps.checks.outputs.has_new_release == 'true'
         run: |

.github/workflows/release-latest.yaml

@@ -286,7 +286,9 @@ jobs:
         run: bunx attw package.tgz
 
   release:
-    permissions: write-all
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - test
       - attw
@@ -305,7 +307,7 @@ jobs:
     runs-on: ubuntu-22.04
     # force empty so npm can use OIDC
     env:
-      NODE_AUTH_TOKEN: ""   
+      NODE_AUTH_TOKEN: ""
       NPM_TOKEN: ""
     services:
       postgres-postgis:
@@ -366,15 +368,15 @@ jobs:
       - uses: actions/setup-node@v6
         with: { node-version: '24', cache: 'pnpm', cache-dependency-path: pnpm-lock.yaml }
       - run: pnpm install --frozen-lockfile --prefer-offline
-
-      # nuke, so npm can use OIDC
-      - name: Remove temp npmrc
-        run: rm -f "$NPM_CONFIG_USERCONFIG"
 
       # >= 11.5.1 for trusted publishing
       - name: Update NPM
         run: npm install -g npm@latest
 
+      # nuke, so npm can use OIDC
+      - name: Remove temp npmrc
+        run: rm -f "$NPM_CONFIG_USERCONFIG"
+
       - name: Check preconditions
         id: checks
         shell: bash
@@ -421,9 +423,6 @@ jobs:
         shell: bash
         run: npm run pack
 
-      # nuke, so npm can use OIDC
-      - name: Remove temp npmrc
-        run: rm -f "$NPM_CONFIG_USERCONFIG"
       - name: Publish
         if: steps.checks.outputs.has_new_release == 'true'
         working-directory: ${{ matrix.package }}