From 493be0686fe13be4dda40bc3d26b63771bd38a0b Mon Sep 17 00:00:00 2001
From: Jan Wendling <jan.wendling@dfinity.org>
Date: Mon, 27 Oct 2025 15:11:44 +0100
Subject: [PATCH] chore: changes workflow for trusted publishing

---
 .github/workflows/release.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b1e3106b..13517619 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,10 @@ jobs:
   release:
     name: release
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -87,7 +91,7 @@ jobs:
         working-directory: packages/ic-certification-testing-wasm
         run: npm publish --access public
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'
 
       - name: Release ic-cbor Cargo crate
         run: cargo publish -p ic-cbor --token ${CRATES_TOKEN}
@@ -107,7 +111,7 @@ jobs:
         working-directory: packages/certificate-verification-js
         run: npm publish --access public
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'
 
       - name: Release ic-response-verification Cargo crate
         run: cargo publish -p ic-response-verification --token ${CRATES_TOKEN}
@@ -122,7 +126,7 @@ jobs:
         working-directory: packages/ic-response-verification-wasm
         run: npm publish --access public
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'
 
       - name: Release ic-asset-certification Cargo crate
         run: cargo publish -p ic-asset-certification --token ${CRATES_TOKEN}
@@ -130,7 +134,7 @@ jobs:
           CRATES_TOKEN: ${{ secrets.CRATES_TOKEN }}
 
       - name: Create Github release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
         with:
           artifacts: >
             target/package/ic-certification-${{ github.ref_name }}.crate,