From a1925e05dfc33deb5915d30f00bebf616dd7d930 Mon Sep 17 00:00:00 2001
From: Charles-Mathieu Seguin <charles.mathieu.seguin@gmail.com>
Date: Sat, 24 Oct 2026 17:10:31 -0700
Subject: [PATCH] ci: publish to npm via trusted publishing

- grant id-token: write so semantic-release can use OIDC
- grant contents/issues/pull-requests write for semantic-release/git and github
- drop NPM_TOKEN from the workflows and remove the repo .npmrc
- migrate the alpha workflow to OIDC and replace deprecated set-output

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/release-alpha.yml | 12 ++++++------
 .github/workflows/release.yml       |  9 ++++++---
 .npmrc                              |  1 -
 3 files changed, 12 insertions(+), 10 deletions(-)
 delete mode 100644 .npmrc

diff --git a/.github/workflows/release-alpha.yml b/.github/workflows/release-alpha.yml
index 15f47ba..5ee5b91 100644
--- a/.github/workflows/release-alpha.yml
+++ b/.github/workflows/release-alpha.yml
@@ -7,6 +7,10 @@ on:
     # paths-ignore:
     #   - '.github/**'
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -15,10 +19,10 @@ jobs:
       - uses: actions/checkout@v6
       - name: Extract version from branch name
         id: extract_version
-        run: echo "::set-output name=version::$(echo ${{ github.ref }} | sed -n 's/refs\/heads\/releases\/\(.*\)-alpha/\1/p')"
+        run: echo "version=$(echo ${{ github.ref }} | sed -n 's/refs\/heads\/releases\/\(.*\)-alpha/\1/p')" >> "$GITHUB_OUTPUT"
       - name: Extract rc from package.json
         id: next_extract_rc
-        run: echo "::set-output name=rc::$(npm show rollup-plugin-react-scoped-css versions --json | grep -E '${{ steps.extract_version.outputs.version }}-alpha' | sed 's/"//g; s/,//g' | sort -V | tail -n 1 | tail | awk -F '-alpha\\.' '{if (NF > 1) {print $2 + 1} else {print 0}}')"
+        run: echo "rc=$(npm show rollup-plugin-react-scoped-css versions --json | grep -E '${{ steps.extract_version.outputs.version }}-alpha' | sed 's/"//g; s/,//g' | sort -V | tail -n 1 | tail | awk -F '-alpha\\.' '{if (NF > 1) {print $2 + 1} else {print 0}}')" >> "$GITHUB_OUTPUT"
       - name: Use Node.js 24.x
         uses: actions/setup-node@v6
         with:
@@ -33,8 +37,4 @@ jobs:
           echo "Version: ${{ steps.extract_version.outputs.version }}-alpha.${{ steps.next_extract_rc.outputs.rc }}"
           npm version ${{ steps.extract_version.outputs.version }}-alpha.${{ steps.next_extract_rc.outputs.rc }} --no-git-tag-version
       - name: Release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public --tag alpha
-      
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 373d643..0a96a7c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,12 @@ on:
     paths-ignore:
       - '.github/**'
 
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  id-token: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -24,7 +30,4 @@ jobs:
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release
-      
-  
\ No newline at end of file
diff --git a/.npmrc b/.npmrc
deleted file mode 100644
index bd3327a..0000000
--- a/.npmrc
+++ /dev/null
@@ -1 +0,0 @@
-//registry.npmjs.org/:_authToken=${NPM_TOKEN}
\ No newline at end of file