Use Trusted Publishing instead of long-lived npm token

See https://docs.npmjs.com/trusted-publishers

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 93b48785964d1ed5bc511d2e8b122cd4b12cfb22..3cbfb73060dc05477aae9a087014331c7f824b61 100644 (file)
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,10 +4,6 @@ on:
   push:
     tags:
       - "v*.*.*"
-  workflow_call:
-    secrets:
-      NPM_TOKEN:
-        required: true
 
 jobs:
   release:
@@ -38,7 +34,6 @@ jobs:
           node-version-file: ".node-version"
           cache: npm
           registry-url: "https://registry.npmjs.org"
+      - run: npm install -g npm@latest # npm >=11.5.1 required for trusted publishing
       - run: npm ci
       - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}