chore(ci): enable trusted publishing

.github/workflows/release.yml

@@ -8,7 +8,7 @@ defaults:
   run:
     shell: bash
 
-permissions: write-all
+permissions: none
 
 # Cancel any in-flight jobs for the same PR/branch so there's only one active
 # at a time
@@ -19,6 +19,8 @@ concurrency:
 jobs:
   build:
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         include:
@@ -64,9 +66,14 @@ jobs:
       with:
         name: bins-${{ matrix.build }}
         path: dist
+
   publish:
-    needs: [build]
+    needs:
+      - build
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v2
       # Download all the artifacts that we'll be publishing. Should keep an eye on
@@ -116,23 +123,22 @@ jobs:
       # with this `sha`. Note that `continue-on-error` is set here so if this hits
       # a bug we can go back and fetch and upload the release ourselves.
       - run: cd .github/actions/github-release && npm install --production
+
       - name: Publish Release
         uses: ./.github/actions/github-release
         if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
+        continue-on-error: true
         with:
           files: "dist/*"
           token: ${{ secrets.GITHUB_TOKEN }}
           name: ${{ steps.tagname.outputs.val }}
-        continue-on-error: true
+
       - name: Update npm packages to latest version
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
         working-directory: ./npm/wizer
         run: npm install && node update.js "${{ steps.tagname.outputs.val }}"
-      - name: Setup npm auth
-        run: sudo npm config --global set '//registry.npmjs.org/:_authToken'='${NODE_AUTH_TOKEN}'
+
       - name: Publish npm packages
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
         working-directory: ./npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: for dir in *; do (echo $dir && cd $dir && npm publish); done