Use NPM trusted publishing #40

	name: Release & Publish

	on:
	push:
	tags:
	# Note: this pattern is protected by a ruleset in the repo.
	# Any changes to this pattern must be reflected in the ruleset.
	- 'v*'

	jobs:
	release:
	runs-on: ubuntu-x64-small
	permissions:
	contents: write
	steps:
	- name: Checkout code
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
	with:
	persist-credentials: 'false'
	- name: Create Release
	id: create_release
	uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4 TODO this is unmaintained
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	tag_name: ${{ github.ref }}
	release_name: ${{ github.ref }}
	draft: false
	prerelease: false

	publish:
	runs-on: ubuntu-x64-small
	environment: 'NPM Trusted Publishing'
	permissions:
	contents: read
	id-token: write
	steps:
	- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
	with:
	persist-credentials: 'false'
	- name: Setup .npmrc file to publish to npm
	uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # 6.0.0
	with:
	node-version: '24.7.0'
	registry-url: 'https://registry.npmjs.org'
	package-manager-cache: false
	- name: Install modules
	run: yarn
	- name: Build
	run: yarn build
	- name: Publish to npm
	run: yarn publish --access public

Provide feedback