From ce754ad19a539530f148cf3dca4a0ed3090bf6e4 Mon Sep 17 00:00:00 2001
From: Ardis Lu <ardisglu@gmail.com>
Date: Thu, 18 Sep 2025 00:10:55 -0700
Subject: [PATCH] Use Trusted Publishing instead of long-lived npm token

See https://docs.npmjs.com/trusted-publishers
---
 .github/workflows/release.yml | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 93b4878..3cbfb73 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,10 +4,6 @@ on:
   push:
     tags:
       - "v*.*.*"
-  workflow_call:
-    secrets:
-      NPM_TOKEN:
-        required: true
 
 jobs:
   release:
@@ -38,7 +34,6 @@ jobs:
           node-version-file: ".node-version"
           cache: npm
           registry-url: "https://registry.npmjs.org"
+      - run: npm install -g npm@latest # npm >=11.5.1 required for trusted publishing
       - run: npm ci
       - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-- 
2.47.3