build: added trusted publishing

Author: alanscodelog

.github/workflows/release.yml

@@ -10,13 +10,20 @@ on:
   repository_dispatch:
     types: [ release ]
 
+permissions:
+  id-token: write 
+
 jobs:
   release:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         node-version: ["lts/*"]
-
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for trusted publishing and npm provenance
     steps:
     - uses: actions/checkout@v6
 
@@ -41,14 +48,12 @@ jobs:
       if: "env.ENABLE_RELEASE == 'true' && ! contains('refs/heads/build ', github.ref)"
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       run: pnpm semantic-release
 
     - name: Release Dry Run
       if: "env.ENABLE_RELEASE != 'true' || contains('refs/heads/build ', github.ref)"
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       run: pnpm semantic-release --dry-run 
 
     - run: echo "env.ENABLE_RELEASE is ${{ env.ENABLE_RELEASE == 'true' }} and branch is ${{ github.ref }}, no release can be published." && exit 1