From: Ardis Lu <ardisglu@gmail.com>
Date: Thu, 18 Sep 2025 07:10:55 +0000 (-0700)
Subject: Use Trusted Publishing instead of long-lived npm token
X-Git-Tag: v0.1.6~3
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=ce754ad19a539530f148cf3dca4a0ed3090bf6e4;p=csvio

Use Trusted Publishing instead of long-lived npm token

See https://docs.npmjs.com/trusted-publishers
---

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 93b4878..3cbfb73 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,10 +4,6 @@ on:
   push:
     tags:
       - "v*.*.*"
-  workflow_call:
-    secrets:
-      NPM_TOKEN:
-        required: true
 
 jobs:
   release:
@@ -38,7 +34,6 @@ jobs:
           node-version-file: ".node-version"
           cache: npm
           registry-url: "https://registry.npmjs.org"
+      - run: npm install -g npm@latest # npm >=11.5.1 required for trusted publishing
       - run: npm ci
       - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}