enable trusted publishing

only change: remove node_auth_token, add id-token: write permission

Author: minrk

.github/workflows/publish.yml

@@ -23,12 +23,15 @@ on:
       - "**"
   workflow_dispatch:
 
+permissions:
+  id-token: write # for publishing to npm
+  contents: read
+
 jobs:
-  # Run tests using node, publish a package when tagged
   # https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
 
   publish-npm:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v5
@@ -38,11 +41,9 @@ jobs:
       - run: npm ci
       - run: npm publish
         if: startsWith(github.ref, 'refs/tags/')
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.npm_token }}
 
   publish-docker:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v5