From 44f71ce8457bcb87481020b974a251ac0e6ce4df Mon Sep 17 00:00:00 2001
From: dangreen <danon0404@gmail.com>
Date: Thu, 3 Sep 2026 15:09:54 +0400
Subject: [PATCH] ci: publish through npm trusted publishing

The release job gets `id-token: write` and no longer takes an npm token.
`registry-url` goes with it: `setup-node` writes an `.npmrc` with an
`_authToken` placeholder for it, and that placeholder shadows OIDC.
---
 .github/workflows/release.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6b9bcae..c79f10f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,6 +39,9 @@ jobs:
     name: Release
     needs: check
     if: needs.check.outputs.workflow == 'release'
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v7
@@ -51,7 +54,6 @@ jobs:
         with:
           node-version: 24
           cache: 'pnpm'
-          registry-url: 'https://registry.npmjs.org'
       - name: Install dependencies
         run: pnpm install
       - name: Release
@@ -59,4 +61,3 @@ jobs:
         with:
           workflow: release
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          npm-token: ${{ secrets.NPM_TOKEN }}