ci: publish to npm via trusted publishing (OIDC)

.github/workflows/release-alpha.yml

@@ -7,6 +7,10 @@ on:
     # paths-ignore:
     #   - '.github/**'
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -15,10 +19,10 @@ jobs:
       - uses: actions/checkout@v6
       - name: Extract version from branch name
         id: extract_version
-        run: echo "::set-output name=version::$(echo ${{ github.ref }} | sed -n 's/refs\/heads\/releases\/\(.*\)-alpha/\1/p')"
+        run: echo "version=$(echo ${{ github.ref }} | sed -n 's/refs\/heads\/releases\/\(.*\)-alpha/\1/p')" >> "$GITHUB_OUTPUT"
       - name: Extract rc from package.json
         id: next_extract_rc
-        run: echo "::set-output name=rc::$(npm show rollup-plugin-react-scoped-css versions --json | grep -E '${{ steps.extract_version.outputs.version }}-alpha' | sed 's/"//g; s/,//g' | sort -V | tail -n 1 | tail | awk -F '-alpha\\.' '{if (NF > 1) {print $2 + 1} else {print 0}}')"
+        run: echo "rc=$(npm show rollup-plugin-react-scoped-css versions --json | grep -E '${{ steps.extract_version.outputs.version }}-alpha' | sed 's/"//g; s/,//g' | sort -V | tail -n 1 | tail | awk -F '-alpha\\.' '{if (NF > 1) {print $2 + 1} else {print 0}}')" >> "$GITHUB_OUTPUT"
       - name: Use Node.js 24.x
         uses: actions/setup-node@v6
         with:
@@ -33,8 +37,4 @@ jobs:
           echo "Version: ${{ steps.extract_version.outputs.version }}-alpha.${{ steps.next_extract_rc.outputs.rc }}"
           npm version ${{ steps.extract_version.outputs.version }}-alpha.${{ steps.next_extract_rc.outputs.rc }} --no-git-tag-version
       - name: Release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public --tag alpha
-

.github/workflows/release.yml

@@ -7,6 +7,12 @@ on:
     paths-ignore:
       - '.github/**'
 
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  id-token: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -24,7 +30,4 @@ jobs:
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npx semantic-release
-
-