fix(ci): publish to npm via OIDC trusted publishing

Author: MarcoAntolini

.github/workflows/publish.yml

@@ -8,6 +8,10 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: write
+  id-token: write
+
 jobs:
   publish:
     if: >
@@ -21,22 +25,12 @@ jobs:
           version: 8
       - uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: 22.x
           registry-url: https://registry.npmjs.org
           cache: pnpm
 
-      - name: Verify npm publish credentials
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          if [ -z "$NODE_AUTH_TOKEN" ]; then
-            echo "::error::NPM_TOKEN secret is not set. Add an npm Automation token with publish access to ts-hover-prettify under GitHub repo Settings → Secrets → Actions."
-            exit 1
-          fi
-          npm whoami || {
-            echo "::error::npm auth failed. Regenerate an npm Automation token for account 'marco.antolini' and update the NPM_TOKEN secret."
-            exit 1
-          }
+      - name: Ensure npm supports trusted publishing (OIDC)
+        run: npm install -g npm@latest && npm --version && node --version
 
       - run: pnpm install --frozen-lockfile
       - name: Create Release Pull Request or Publish
@@ -46,5 +40,3 @@ jobs:
           publish: pnpm run release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}