chore(ci): use trusted publishing

Author: gregberge

.github/workflows/CI.yml

@@ -255,6 +255,7 @@ jobs:
         with:
           node-version: 24
           cache: pnpm
+          registry-url: 'https://registry.npmjs.org'
       - name: Install dependencies
         run: pnpm install
       - name: create npm dirs
@@ -273,29 +274,24 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           SHA: ${{ github.event.pull_request.head.sha }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           if [ "${{ github.event.pull_request.head.repo.fork }}" = "true" ]
           then
             echo "Fork PR, skipping publish"
             exit 0
           fi
 
-          npm config set provenance true
-
           MESSAGE="$(gh api "repos/$REPO/commits/$SHA" --jq '.commit.message')"
           FIRST_LINE="$(printf '%s' "$MESSAGE" | head -n 1 | tr -d '\r')"
 
           echo "Latest commit: $FIRST_LINE"
 
           if printf '%s' "$FIRST_LINE" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'
           then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --access public
+            npm publish --provenance --access public
           elif printf '%s' "$FIRST_LINE" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+'
           then
-            echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
-            npm publish --tag next --access public
+            npm publish --provenance --tag next --access public
           else
             echo "Not a release, skipping publish"
           fi