ci: enable OIDC trusted publishing

Author: webfansplz

.github/workflows/release-commit.yml

@@ -0,0 +1,11 @@
+name: Publish Any Commit
+on: [push, pull_request]
+
+permissions: {}
+
+jobs:
+  release:
+    uses: sxzz/workflows/.github/workflows/release-commit.yml@v1
+    with:
+      packages: "'./packages/*'"
+      compact: true

.github/workflows/release.yml

@@ -5,21 +5,12 @@ on:
     tags:
       - 'v*'
 
-permissions:
-  contents: write
-
 jobs:
   release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-
-      - run: npx changelogithub
-        env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+    uses: sxzz/workflows/.github/workflows/release.yml@v1
+    with:
+      publish: true
+      build: pnpm run build
+    permissions:
+      contents: write
+      id-token: write

package.json

@@ -54,8 +54,7 @@
     "lint:fix": "pnpm lint --fix",
     "lint:packages": "pnpm -r --filter='./packages/{core,devtools,devtools-api,devtools-kit,electron,shared,applet}' exec publint && pnpm -r --filter='./packages/{core,devtools,devtools-api,devtools-kit,electron,shared,applet}' exec attw --pack",
     "prepublishOnly": "npm run build",
-    "release": "bumpp && nr build && pnpm -r publish --access public",
-    "release:beta": "bumpp && nr build && pnpm -r publish --access public --tag beta",
+    "release": "bumpp -r",
     "dep:up": "taze -I major -r",
     "prepare": "simple-git-hooks",
     "test": "vitest --environment jsdom",