fix(npm): update npm publishing to use OIDC

.github/workflows/release.yml

@@ -39,6 +39,9 @@ jobs:
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Publish to npm (Trusted Publisher)
+        run: npm publish --provenance --access public
+
       - name: Build Static Asset
         run: npm run build-static
 

package.json

@@ -32,6 +32,9 @@
       "require": "./dist/cast-ui.umd.js"
     }
   },
+  "publishConfig": {
+    "provenance": true
+  },
   "sideEffects": [
     "**/*.css"
   ],
@@ -98,4 +101,4 @@
       "path": "./node_modules/cz-conventional-changelog"
     }
   }
-}
+}

release.config.cjs

@@ -1,4 +1,4 @@
 const branch = process.env.BRANCH_NAME;
 
 const config = {
   branches: [
@@ -9,7 +9,7 @@
   plugins: [
     'commit-analyzer-fail-on-no-release',
     '@semantic-release/release-notes-generator',
-    '@semantic-release/npm',
+    ['@semantic-release/npm', { npmPublish: false }],
     '@semantic-release/github',
   ],
 };
@@ -36,4 +36,4 @@
   );
 }
 
 module.exports = config;