ci: use npm trusted publishing with provenance #3

	name: Publish to npm

	on:
	push:
	branches:
	- master

	jobs:
	test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 20
	- run: npm ci
	- run: npm test

	publish:
	needs: test
	runs-on: ubuntu-latest
	permissions:
	contents: write
	id-token: write
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 20
	registry-url: https://registry.npmjs.org
	- run: npm ci
	- run: npm run build
	- name: Bump patch version
	run: \|
	git config user.name "github-actions[bot]"
	git config user.email "github-actions[bot]@users.noreply.github.com"
	npm version patch --no-git-tag-version
	VERSION=$(node -p "require('./package.json').version")
	echo "VERSION=$VERSION" >> $GITHUB_ENV
	- name: Publish to npm (provenance)
	run: npm publish --access=public --provenance
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	- name: Push version bump
	run: \|
	git add package.json package-lock.json
	git commit -m "chore: bump version to ${{ env.VERSION }} [skip ci]"
	git push

Provide feedback