ci: Use Trusted publishing (#87)

Author: OS-pedrogustavobilro

.github/actions/setup-tools/action.yml

@@ -7,7 +7,10 @@ runs:
     - name: Install Node.js
       uses: actions/setup-node@v4
       with:
-        node-version: 20
+        node-version: 22 # semantic-release requires at least this version
+    - name: Update npm # To ensure npm 11.5.1 or later is installed for Trusted publishing
+      shell: bash
+      run: npm install -g npm@latest
     - name: Install dependencies
       shell: bash
       run: npm i

.github/workflows/release.yml

@@ -12,6 +12,7 @@ permissions:
     contents: write
     issues: write
     deployments: write
+    id-token: write # to enable use of OIDC for npm provenance and trusted publishing
 
 jobs:
   setup:
@@ -46,5 +47,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.CAP_GH_RELEASE_TOKEN }}
           GH_TOKEN: ${{ secrets.CAP_GH_RELEASE_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
         run: npx semantic-release

package.json

@@ -63,8 +63,8 @@
     "@rollup/wasm-node": "~4.19.0",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^10.1.2",
-    "@semantic-release/npm": "^12.0.1",
+    "@semantic-release/github": "^12.0.0",
+    "@semantic-release/npm": "^13.1.1",
     "@typescript-eslint/eslint-plugin": "~7.17.0",
     "@typescript-eslint/parser": "~7.17.0",
     "eslint": "^8.56.0",
@@ -73,7 +73,7 @@
     "prettier": "~3.3.3",
     "prettier-plugin-java": "~2.6.4",
     "rimraf": "^3.0.2",
-    "semantic-release": "^24.0.0",
+    "semantic-release": "^25.0.1",
     "swiftlint": "^1.0.2",
     "typescript": "~5.4.5",
     "vite": "^5.2.11",