chore: switch to trusted publishing

Author: Shinigami92

.github/workflows/publish.yml

@@ -3,6 +3,10 @@ name: Publish
 on:
   workflow_dispatch:
 
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
 jobs:
   release:
     if: github.ref == 'refs/heads/main'
@@ -15,21 +19,16 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
 
-      - name: Set node version to 22
+      - name: Set node version to 24
         uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
-          node-version: 22.22.0
+          node-version: 24
           cache: 'pnpm'
 
       - name: Prepare
         run: pnpm install --frozen-lockfile
 
-      - name: Set publishing config
-        run: pnpm config set '//registry.npmjs.org/:_authToken' "${NODE_AUTH_TOKEN}"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Publish
         run: |
           PACKAGE_DIST_TAG=$(node -e "console.log(/^\d+\.\d+\.\d+(\-(\w+)\.\d+)$/.exec(require('./package.json').version)?.[2] || 'latest')")
-          pnpm publish --access public --tag $PACKAGE_DIST_TAG
+          pnpm publish --access public --tag $PACKAGE_DIST_TAG --provenance

package.json

@@ -93,7 +93,7 @@
     "@stylistic/eslint-plugin": "5.7.0",
     "@testcontainers/postgresql": "11.11.0",
     "@types/config": "3.3.5",
-    "@types/node": "20.19.29",
+    "@types/node": "20.19.33",
     "@types/pg": "8.16.0",
     "@types/yargs": "17.0.35",
     "@vitest/coverage-v8": "4.0.17",
@@ -131,7 +131,7 @@
       "optional": true
     }
   },
-  "packageManager": "pnpm@10.28.0",
+  "packageManager": "pnpm@10.29.3",
   "engines": {
     "node": ">=20.11.0"
   }