[optimize] enable NPM provenance for publishing

Author: TechQuery

.github/workflows/main.yml

@@ -12,6 +12,9 @@ jobs:
     ci:
         name: Build / Preview / Release
         runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            id-token: write
         steps:
             - uses: actions/checkout@v4
 
@@ -28,7 +31,7 @@ jobs:
 
             - name: Build & Publish
               if: env.IS_RELEASE
-              run: npm publish
+              run: npm publish --access public --provenance
               env:
                   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}